CVE-2022-24880
Potential Captcha Validate Bypass in flask-session-captcha
5.3
MEDIUM
CVSS 3.1
EPSS 0.25%
描述
flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.
如何修補 CVE-2022-24880
要修補 CVE-2022-24880,請將受影響套件升級到下列已修補版本。
- —升級至 1.2.1 或更新版本
- —升級至 2811ae23a38d33b620fb7a07de8837c6d65c13e4 或更新版本
CVE-2022-24880 正在被利用嗎?
低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。
受影響套件(2)
- from 0, < 1.2.1
- from 0, < 2811ae23a38d33b620fb7a07de8837c6d65c13e4 | from 0, < 1.2.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |