CVE-2022-24880

Katalog CVE

CVSS 5.3 · Medium EPSS 1,2%

Kerentanan Incorrect Check of Function Return Value pada flask-session-captcha project flask-session-captcha. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.

Rincian

Terbit di NVD

25 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-253: Incorrect Check of Function Return Value
CWE-394: Unexpected Status Code or Return Value
CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4 patch · advisory pihak ketiga
• https://github.com/Tethik/flask-session-captcha/pull/27 patch · advisory pihak ketiga
• https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1 release notes · advisory pihak ketiga
• https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45 advisory pihak ketiga