{"containers": {"cna": {"affected": [{"product": "flask-session-captcha", "vendor": "Tethik", "versions": [{"status": "affected", "version": "< 1.2.1"}]}], "descriptions": [{"lang": "en", "value": "flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-253", "description": "CWE-253: Incorrect Check of Function Return Value", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-394", "description": "CWE-394: Unexpected Status Code or Return Value", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-25T22:10:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Tethik/flask-session-captcha/pull/27"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1"}], "source": {"advisory": "GHSA-7r87-cj48-wj45", "discovery": "UNKNOWN"}, "title": "Potential Captcha Validate Bypass in flask-session-captcha", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24880", "STATE": "PUBLIC", "TITLE": "Potential Captcha Validate Bypass in flask-session-captcha"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "flask-session-captcha", "version": {"version_data": [{"version_value": "< 1.2.1"}]}}]}, "vendor_name": "Tethik"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-253: Incorrect Check of Function Return Value"}]}, {"description": [{"lang": "eng", "value": "CWE-394: Unexpected Status Code or Return Value"}]}, {"description": [{"lang": "eng", "value": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45", "refsource": "CONFIRM", "url": "https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45"}, {"name": "https://github.com/Tethik/flask-session-captcha/pull/27", "refsource": "MISC", "url": "https://github.com/Tethik/flask-session-captcha/pull/27"}, {"name": "https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4", "refsource": "MISC", "url": "https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4"}, {"name": "https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1", "refsource": "MISC", "url": "https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1"}]}, "source": {"advisory": "GHSA-7r87-cj48-wj45", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24880", "datePublished": "2022-04-25T22:10:13", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2022-04-25T22:10:13", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:flask-session-captcha_project:flask-session-captcha:*:*:*:*:*:*:*:*", "matchCriteriaId": "6FD99903-1464-46F1-8437-BDE027792C34", "versionEndExcluding": "1.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work."}, {"lang": "es", "value": "flask-session-captcha es un paquete que permite a usuarios ampliar Flask al a\u00f1adir un captcha basado en una imagen almacenada en una sesi\u00f3n del lado del servidor. En versiones anteriores a 1.2.1, la funci\u00f3n \"captcha.validate()\" devolv\u00eda \"None\" si no le es pasado ning\u00fan valor (por ejemplo, al enviar un formulario vac\u00edo). Si usuarios implementadores comprobaban que el valor de retorno era **False**, la comprobaci\u00f3n del captcha pod\u00eda omitirse. La versi\u00f3n 1.2.1 corrige el problema. Los usuarios pueden mitigar el problema al no comprobar expl\u00edcitamente que el valor es False. Comprobar el valor de retorno de forma menos expl\u00edcita deber\u00eda seguir funcionando"}], "id": "CVE-2022-24880", "lastModified": "2022-05-05T18:20:02.583", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-04-25T22:15:43.883", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Tethik/flask-session-captcha/pull/27"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-253"}, {"lang": "en", "value": "CWE-394"}, {"lang": "en", "value": "CWE-754"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}