Vulnerability Description
flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Flask-Session-Captcha Project | Flask-Session-Captcha | < 1.2.1 |
Related Weaknesses (CWE)
References
- https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07dPatchThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/pull/27PatchThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1Release NotesThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cjThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07dPatchThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/pull/27PatchThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1Release NotesThird Party Advisory
- https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cjThird Party Advisory
FAQ
What is CVE-2022-24880?
CVE-2022-24880 is a vulnerability with a CVSS score of 5.3 (MEDIUM). flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function wou...
How severe is CVE-2022-24880?
CVE-2022-24880 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24880?
Check the references section above for vendor advisories and patch information. Affected products include: Flask-Session-Captcha Project Flask-Session-Captcha.