Homepage
About Snyk

Information Exposure Affecting flask package, versions [,2.2.5) [2.3.0,2.3.2)

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High

    Threat Intelligence

    EPSS 0.14% (50th percentile)
Expand this section
NVD
7.5 high
Expand this section
SUSE
7.5 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-FLASK-5490129
  • published 2 May 2023
  • disclosed 1 May 2023
  • credit Tom Most
Report a new vulnerability Found a mistake?

Introduced: 1 May 2023

CVE-2023-30861 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade flask to version 2.2.5, 2.3.2 or higher.

Overview

Affected versions of this package are vulnerable to Information Exposure in the form of exposing the permanent session cookie, when all of the following conditions are met:

  1. The application is hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.

  2. The application sets session.permanent = True.

  3. The application does not access or modify the session at any point during a request.

  4. SESSION_REFRESH_EACH_REQUEST is enabled (the default).

  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

A response containing data intended for one client may be cached and sent to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. Under these conditions, the Vary: Cookie header is not set when a session is refreshed (re-sent to update the expiration) without being accessed or modified.