Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

flask-session-captcha

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9PyPIAmendedPublished

    Potential Captcha Validate Bypass in flask-session-captcha

    CVE-2022-24880 · GHSA-7r87-cj48-wj45

    Affected
    • PyPI flask-session-captcha < 1.2.1
    Fixed in
    1.2.1· Vendor fix available
    Issue
    Impact flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. The captcha.validate() function would return None if passed no value (e.g. by submitting a request with an empty form). If implementing users were checking the return value to be False, the captcha verification check could be bypassed. Sample vulnerable code: Patches A new version (1.2.1) is available that fixes the issue. Workarounds Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work. References https://github.com/Tethik/flask-session-captcha/pull/27 For more information If you have any questions or comments about this advisory: Open an issue in the github repo

    Recommended action: Upgrade to 1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →