GitHub Advisoryadvisory · PyPI

GHSA-hggv-mcp4-vxc5 Improper Authentication in FreeTAKServer

HIGH Published 2022-03-12 Modified 2026-06-10 Official page ↗
Aliases
CVE-2022-25508
Ecosystem
PyPI
Packages
FreeTAKServer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-287, CWE-306
Reviewed
2022-03-14

Affected packages

• PyPI FreeTAKServer: < 1.9.8.5 → fixed in 1.9.8.5

Description

FreeTAKServer is an open source, lightweight Server for connect TAK clients. An access control issue in the component /ManageRoute/postRoute of FreeTAKServer version 1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users. There is currently no known workaround. This issue was fixed in version 1.9.8.5.

Related

Alias · CVE (1)

  • CVE-2022-25508 An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers to cause a Denial… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-306 Missing Authentication for Critical Functionality weakness

References