GitHub Advisoryadvisory · PyPI

GHSA-f897-875p-23x7 Hard coded credentials in FreeTAKServer

HIGH Published 2022-03-12 Modified 2024-11-26 Official page ↗
Aliases
CVE-2022-25510
Ecosystem
PyPI
Packages
FreeTAKServer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-798
Reviewed
2022-03-14

Affected packages

• PyPI FreeTAKServer: < 1.9.8.5 → fixed in 1.9.8.5

Description

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.

Related

Alias · CVE (1)

  • CVE-2022-25510 FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or… vulnerability

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References