Information Disclosure

2023-05-0403:01:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

flask

information disclosure

vary cookie header

save_session function

sessions.py

0.002 Low

EPSS

Percentile

57.1%

JSON

flask is vulnerable to Information Disclosure. The vulnerability exists due to the missing Vary cookie header in the save_session function of sessions.py, which leads to the disclosure of the session cookie, or sending data to a client who did not make the request.

CPENameOperatorVersion
flaskle2.2.4
flaskle2.3.1
flaskle1.1.4
python-flaskeq0.10.1__5.el7_7
python-flaskeq2.0.1__2.el9.1
python-flaskeq1.0.2__7.el8ost.1
python-flaskeq0.10.1__4.el7
python-flaskeq0.10.1__5.el7
python-flaskeq1.0.2__2.el8ost
python-flaskeq0.10.1__4.el7ui

Name	Operator	Version
flask	le	2.2.4
flask	le	2.3.1
flask	le	1.1.4
python-flask	eq	0.10.1__5.el7_7
python-flask	eq	2.0.1__2.el9.1
python-flask	eq	1.0.2__7.el8ost.1
python-flask	eq	0.10.1__4.el7
python-flask	eq	0.10.1__5.el7
python-flask	eq	1.0.2__2.el8ost
python-flask	eq	0.10.1__4.el7ui