Information Exposure Affecting flask package, versions [,2.2.5) [2.3.0,2.3.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-FLASK-5490129
- published 2 May 2023
- disclosed 1 May 2023
- credit Tom Most
Introduced: 1 May 2023
CVE-2023-30861 Open this link in a new tabHow to fix?
Upgrade flask to version 2.2.5, 2.3.2 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure in the form of exposing the permanent session cookie, when all of the following conditions are met:
The application is hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
The application sets
session.permanent = True.The application does not access or modify the session at any point during a request.
SESSION_REFRESH_EACH_REQUESTis enabled (the default).The application does not set a
Cache-Controlheader to indicate that a page is private or should not be cached.
A response containing data intended for one client may be cached and sent to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. Under these conditions, the Vary: Cookie header is not set when a session is refreshed (re-sent to update the expiration) without being accessed or modified.