Vulnerability in Pallets Flask
CVE-2023-30861
Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.013 (69.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 69th percentile — 69.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Pallets Flask — versions >= 2.3.0, < 2.3.2, < 2.2.5
- Palletsprojects Flask
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq (Vendor Advisory)
- github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b (Patch)
- github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965 (Patch)
- github.com/pallets/flask/releases/tag/2.2.5 (Release Notes)
- github.com/pallets/flask/releases/tag/2.3.2 (Release Notes)
- www.debian.org/security/2023/dsa-5442
- security.netapp.com/advisory/ntap-20230818-0006/
- lists.debian.org/debian-lts-announce/2023/08/msg00024.html
Frequently asked questions
- What is CVE-2023-30861?
- CVE-2023-30861 is a high-severity vulnerability in Pallets Flask, classified under CWE-539. CVSS score: 7.5/10. Published 2023-05-02.
- How severe is CVE-2023-30861?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-30861 known to be exploited?
- 20 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.