[GHSA-m2qf-hxjv-5gpq] Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json

@@ -1,33 +1,24 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m2qf-hxjv-5gpq",
-  "modified": "2024-09-20T17:51:00Z",
+  "modified": "2024-09-20T17:51:02Z",
   "published": "2023-05-01T19:22:20Z",
   "aliases": [
     "CVE-2023-30861"
   ],
   "summary": "Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header",
   "details": "When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n2. The application does not access or modify the session at any point during a request.\n4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
-    },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L"
     }
   ],
   "affected": [
     {
       "package": {
         "ecosystem": "PyPI",
-        "name": "Flask"
-      },
-      "ecosystem_specific": {
-        "affected_functions": [
-          "flask.sessions.SecureCookieSessionInterface.save_session"
-        ]
+        "name": "flask"
       },
       "ranges": [
         {
@@ -46,12 +37,7 @@
     {
       "package": {
         "ecosystem": "PyPI",
-        "name": "Flask"
-      },
-      "ecosystem_specific": {
-        "affected_functions": [
-          "flask.sessions.SecureCookieSessionInterface.save_session"
-        ]
+        "name": "flask"
       },
       "ranges": [
         {
@@ -118,7 +104,7 @@
     "cwe_ids": [
       "CWE-539"
     ],
-    "severity": "HIGH",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2023-05-01T19:22:20Z",
     "nvd_published_at": "2023-05-02T18:15:52Z"