Path Traversal in Cloudflare Wrangler
CVE-2023-3348
The Wrangler command line tool (<=wrangler@3.1.0 or <=wrangler@2.20.1) was affected by a directory traversal vulnerability when running a local development server for Pages (wrangler pages dev command). This vulnerability enabled an attacker in the same network as the victim to connect to the local development server and access the victim's files present outside of the directory for the development server.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.008 (55.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Cloudflare Wrangler — versions 3, 2
Weakness classification (CWE)
References
- github.com/cloudflare/workers-sdk/security/advisories/GHSA-8c93-4hch-xgxp (vendor-advisory, Vendor Advisory)
- github.com/cloudflare/workers-sdk (Product, product)
- developers.cloudflare.com/workers/wrangler/ (related, Product)
Frequently asked questions
- What is CVE-2023-3348?
- CVE-2023-3348 is a medium-severity vulnerability in Cloudflare Wrangler, classified under Path Traversal. CVSS score: 5.7/10. Published 2023-08-03.
- How severe is CVE-2023-3348?
- Medium severity. CVSS v3 base score is 5.7 out of 10.