Every CVE Search/ Get API key

CVE-2023-30861

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

7.5 HighPublic exploitFix available

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.25%Up 1.2 points since May 3, 2023
90%50%10%1%

What each source reports

CVE List Score used 7.5

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
CVE-2023-30861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-539
Updated
2026-11-02
EUVDEUVD-2023-0080 7.5

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
EUVD-2023-0080
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-m2qf-hxjv-5gpq 8.7

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True.
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST is enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.

Record
GHSA-m2qf-hxjv-5gpq
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-539
Updated
2026-11-02
NVD 7.5

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
CVE-2023-30861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-539
Updated
2026-11-02
OSVAZL-43798 7.5

CVE-2023-30861 affecting package python-flask 1.1.1-4

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
AZL-43798
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-44718 7.5

CVE-2023-30861 affecting package python-flask 1.1.1-4

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
AZL-44718
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-05
Show 27 moreShow less
OSV 7.5

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
CVE-2023-30861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-539
Updated
2026-11-02
OSVDEBIAN-CVE-2023-30861 7.5

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets session.permanent = True 3. The application does not access or modify the session at any point during a request. 4. SESSION_REFRESH_EACH_REQUEST enabled (the default). 5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
DEBIAN-CVE-2023-30861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-m2qf-hxjv-5gpq 8.7

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True.
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST is enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.

Record
GHSA-m2qf-hxjv-5gpq
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-539
Updated
2026-11-02
OSVOESA-2023-1922 7.5

python-flask security update

Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks.

Security Fix(es):

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.(CVE-2023-30861)

Record
OESA-2023-1922
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2023-1936 7.5

python-flask security update

Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks.

Security Fix(es):

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.(CVE-2023-30861)

Record
OESA-2023-1936
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3440 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform 17.0 (python-flask) security update

Record
RHSA-2023:3440
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3444 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-flask) security update

Record
RHSA-2023:3444
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3446 7.5

Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-flask) security update

Record
RHSA-2023:3446
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3525 7.5

Red Hat Security Advisory: python-flask security update

Record
RHSA-2023:3525
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3536 9.8

Red Hat Security Advisory: OpenShift Container Platform 4.13.3 packages and security update

Record
RHSA-2023:3536
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2023:3541 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.11.43 packages and security update

Record
RHSA-2023:3541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2023:3545 8.1

Red Hat Security Advisory: OpenShift Container Platform 4.12.21 packages and security update

Record
RHSA-2023:3545
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-PYPI-CVE-2023-30861 7.5

CVE-2023-30861 in Flask - Patched by Root

Root has patched CVE-2023-30861 in the Flask package for Root:PyPI. Multiple fixed versions available.

Record
ROOT-APP-PYPI-CVE-2023-30861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-30861 7.5

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets session.permanent = True 3. The application does not access or modify the session at any point during a request. 4. SESSION_REFRESH_EACH_REQUEST enabled (the default). 5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
UBUNTU-CVE-2023-30861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1772410250 No score

TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.2.post1+tuxcare.

Record
CLSA-2026-1772410250
Updated
2026-11-02
OSVCLSA-2026-1772410251 No score

TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 1.1.4.post1+tuxcare.

Record
CLSA-2026-1772410251
Updated
2026-11-02
OSVCLSA-2026-1772410252 No score

TuxCare security update for flask (1 CVE)

TuxCare rebuilt flask to address 1 CVE. Fixed in 2.2.1.post1+tuxcare.

Record
CLSA-2026-1772410252
Updated
2026-11-02
OSVCLSA-2026-1789986626 No score

TuxCare security update for flask (2 CVEs)

TuxCare rebuilt flask to address 2 CVEs. Fixed in 0.12.5.post2+tuxcare.

Record
CLSA-2026-1789986626
Updated
2026-11-02
OSVCLSA-2026-1789987201 No score

TuxCare security update for flask (2 CVEs)

TuxCare rebuilt flask to address 2 CVEs. Fixed in 2.2.1.post2+tuxcare.

Record
CLSA-2026-1789987201
Updated
2026-11-02
OSVMGASA-2023-0193 No score

Updated python-flask packages fix security vulnerability

Client 'session' cookie sent to other clients (CVE-2023-30861)

Record
MGASA-2023-0193
Updated
2026-11-02
OSVopenSUSE-SU-2024:12923-1 No score

python310-Flask-2.2.5-1.1 on GA media

These are all security issues fixed in the python310-Flask-2.2.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12923-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11902-1 No score

python313-Flask-3.1.3-3.1 on GA media

These are all security issues fixed in the python313-Flask-3.1.3-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11902-1
Updated
2026-11-02
OSVPYSEC-2023-62 No score

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches Set-Cookie headers, it may send one client's session cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met.

  1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.
  2. The application sets session.permanent = True
  3. The application does not access or modify the session at any point during a request.
  4. SESSION_REFRESH_EACH_REQUEST enabled (the default).
  5. The application does not set a Cache-Control header to indicate that a page is private or should not be cached.

This happens because vulnerable versions of Flask only set the Vary: Cookie header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

Record
PYSEC-2023-62
Updated
2026-11-02
OSVSUSE-SU-2023:2263-1 No score

Security update for python-Flask

This update for python-Flask fixes the following issues:

  • CVE-2023-30861: Fixed a potential cookie confusion due to incorrect caching (bsc#1211246).
Record
SUSE-SU-2023:2263-1
Updated
2026-11-02
OSVSUSE-SU-2023:2263-2 No score

Security update for python-Flask

This update for python-Flask fixes the following issues:

  • CVE-2023-30861: Fixed a potential cookie confusion due to incorrect caching (bsc#1211246).
Record
SUSE-SU-2023:2263-2
Updated
2026-11-02
OSVSUSE-SU-2023:2264-1 No score

Security update for python-Flask

This update for python-Flask fixes the following issues:

  • CVE-2023-30861: Fixed a potential cookie confusion due to incorrect caching (bsc#1211246).
Record
SUSE-SU-2023:2264-1
Updated
2026-11-02
OSVUSN-6111-1 No score

flask vulnerability

It was discovered that Flask incorrectly handled certain data responses. An attacker could possibly use this issue to expose sensitive information.

Record
USN-6111-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flask
PyPI
 2.3.0 up to 2.3.2
2.3.2
flask
PyPI
 before 2.2.5
2.2.5
python-flask
Azure Linux:2
 through 1.1.1-4 None known
python-flask
Azure Linux:3
 through 1.1.1-4 None known
flask
TuxCare:PyPI
 1.1.2 up to 1.1.2.post1+tuxcare
1.1.2.post1+tuxcare
flask
TuxCare:PyPI
 1.1.4 up to 1.1.4.post1+tuxcare
1.1.4.post1+tuxcare
flask
TuxCare:PyPI
From an advisory covering 2 CVEs
 0.12.5 up to 0.12.5.post2+tuxcare, plus listed versions
0.12.5.post1+tuxcare
0.12.5.post2+tuxcare
flask
TuxCare:PyPI
From an advisory covering 2 CVEs
 2.2.1 up to 2.2.1.post2+tuxcare, plus listed versions
2.2.1.post1+tuxcare
2.2.1.post2+tuxcare
flask
Debian:12
 before 2.2.2-3
2.2.2-3
flask
Debian:13
 before 2.2.2-3
2.2.2-3
Show 120 moreShow less
Affected packages
PackageAffectedFixed
flask
Debian:14
 before 2.2.2-3
2.2.2-3
flask
Debian:10
 before 1.0.2-3+deb10u1, plus listed versions
1.0.2-3
1.0.2-3+deb10u1
flask
Debian:11
 before 1.1.2-2+deb11u1, plus listed versions
1.1.2-2
1.1.2-2+deb11u1
flask
PyPI
 2.3.0 up to 2.3.2, plus listed versions
2.3.1
2.3.2
flask
PyPI
 before 2.2.5, plus listed versions
0.10.100.10.10.110.11.1
Show 45 moreShow less
0.120.12.10.12.20.12.30.12.40.12.50.20.30.3.10.40.50.5.10.5.20.60.6.10.70.7.10.7.20.80.8.10.91.01.0.11.0.21.0.31.0.41.1.01.1.11.1.21.1.31.1.42.0.02.0.0rc12.0.0rc22.0.12.0.22.0.32.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.3
2.2.5
python-flask
Mageia:8
 before 1.1.2-1.1.mga8
1.1.2-1.1.mga8
python-flask
openEuler:20.03-LTS-SP1
 before 1.1.2-5.oe1
1.1.2-5.oe1
python-flask
openEuler:20.03-LTS-SP3
 before 1.1.2-5.oe1
1.1.2-5.oe1
python-flask
openEuler:22.03-LTS
 before 2.1.2-4.oe2203sp2
2.1.2-4.oe2203sp2
python-flask
openEuler:22.03-LTS-SP1
 before 2.1.2-4.oe2203sp1
2.1.2-4.oe2203sp1
python-flask
openEuler:22.03-LTS-SP2
 before 2.1.2-4.oe2203sp2
2.1.2-4.oe2203sp2
python-flask
openEuler:20.03-LTS-SP4
 before 1.1.2-5.oe2003sp4
1.1.2-5.oe2003sp4
flask
PyPI
 before 2.2.5, 2.3.0 up to 2.3.2, plus listed versions
0.10.100.10.10.110.11.1
Show 45 moreShow less
0.120.12.10.12.20.12.30.12.40.12.50.20.30.3.10.40.50.5.10.5.20.60.6.10.70.7.10.7.20.80.8.10.91.01.0.11.0.21.0.31.0.41.1.01.1.11.1.21.1.31.1.42.0.02.0.0rc12.0.0rc22.0.12.0.22.0.32.1.02.1.12.1.22.1.32.2.02.2.12.2.22.2.3
2.2.52.3.2
python-flask
Red Hat:openstack:17.0::el9
 before 1:1.1.2-6.el9ost
1:1.1.2-6.el9ost
python3-flask
Red Hat:openstack:17.0::el9
 before 1:1.1.2-6.el9ost
1:1.1.2-6.el9ost
python-flask
Red Hat:openstack:16.2::el8
 before 1:1.0.2-8.el8ost
1:1.0.2-8.el8ost
python3-flask
Red Hat:openstack:16.2::el8
 before 1:1.0.2-8.el8ost
1:1.0.2-8.el8ost
python-flask
Red Hat:openstack:16.1::el8
 before 1:1.0.2-8.el8ost
1:1.0.2-8.el8ost
python3-flask
Red Hat:openstack:16.1::el8
 before 1:1.0.2-8.el8ost
1:1.0.2-8.el8ost
python-flask
Red Hat:rhel_extras_other:7
 before 1:0.10.1-7.el7_9
1:0.10.1-7.el7_9
cri-o
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:1.26.3-8.rhaos4.13.git9232b13.el8
0:1.26.3-8.rhaos4.13.git9232b13.el8
cri-o-debuginfo
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:1.26.3-8.rhaos4.13.git9232b13.el8
0:1.26.3-8.rhaos4.13.git9232b13.el8
cri-o-debugsource
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:1.26.3-8.rhaos4.13.git9232b13.el8
0:1.26.3-8.rhaos4.13.git9232b13.el8
cri-o
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:1.26.3-9.rhaos4.13.git9232b13.el9
0:1.26.3-9.rhaos4.13.git9232b13.el9
cri-o-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:1.26.3-9.rhaos4.13.git9232b13.el9
0:1.26.3-9.rhaos4.13.git9232b13.el9
cri-o-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:1.26.3-9.rhaos4.13.git9232b13.el9
0:1.26.3-9.rhaos4.13.git9232b13.el9
openshift
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8
0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8
openshift-ansible
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.0-202305301841.p0.g148be47.assembly.stream.el8
0:4.13.0-202305301841.p0.g148be47.assembly.stream.el8
openshift-ansible-test
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.0-202305301841.p0.g148be47.assembly.stream.el8
0:4.13.0-202305301841.p0.g148be47.assembly.stream.el8
openshift-clients
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8
0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8
openshift-clients-redistributable
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8
0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.13::el8
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8
0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el8
NetworkManager
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-adsl
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-adsl-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-bluetooth
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-bluetooth-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-cloud-setup
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-cloud-setup-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-config-connectivity-redhat
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-config-server
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-dispatcher-routing-rules
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-initscripts-updown
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-libnm
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-libnm-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-libnm-devel
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-ovs
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-ovs-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-ppp
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-ppp-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-team
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-team-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-tui
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-tui-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-wifi
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-wifi-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-wwan
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
NetworkManager-wwan-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 1:1.42.2-2.el9_2
1:1.42.2-2.el9_2
conmon
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 3:2.1.7-1.1.rhaos4.13.el9
3:2.1.7-1.1.rhaos4.13.el9
conmon-debuginfo
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 3:2.1.7-1.1.rhaos4.13.el9
3:2.1.7-1.1.rhaos4.13.el9
conmon-debugsource
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 3:2.1.7-1.1.rhaos4.13.el9
3:2.1.7-1.1.rhaos4.13.el9
openshift
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9
0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9
openshift-ansible
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:4.13.0-202305301841.p0.g148be47.assembly.stream.el9
0:4.13.0-202305301841.p0.g148be47.assembly.stream.el9
openshift-ansible-test
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:4.13.0-202305301841.p0.g148be47.assembly.stream.el9
0:4.13.0-202305301841.p0.g148be47.assembly.stream.el9
openshift-clients
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9
0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9
openshift-clients-redistributable
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9
0:4.13.0-202305312300.p0.g05d83ef.assembly.stream.el9
openshift-hyperkube
Red Hat:openshift:4.13::el9
From an advisory covering 5 CVEs
 before 0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9
0:4.13.0-202305312300.p0.g7a891f0.assembly.stream.el9
python-flask
Red Hat:openshift_ironic:4.13::el9
From an advisory covering 5 CVEs
 before 2:2.0.1-4.el9.2
2:2.0.1-4.el9.2
python-flask-doc
Red Hat:openshift_ironic:4.13::el9
From an advisory covering 5 CVEs
 before 2:2.0.1-4.el9.2
2:2.0.1-4.el9.2
python3-flask
Red Hat:openshift_ironic:4.13::el9
From an advisory covering 5 CVEs
 before 2:2.0.1-4.el9.2
2:2.0.1-4.el9.2
cri-o
Red Hat:openshift:4.11::el8
From an advisory covering 2 CVEs
 before 0:1.24.5-5.rhaos4.11.git8bf967b.el8
0:1.24.5-5.rhaos4.11.git8bf967b.el8
cri-o-debuginfo
Red Hat:openshift:4.11::el8
From an advisory covering 2 CVEs
 before 0:1.24.5-5.rhaos4.11.git8bf967b.el8
0:1.24.5-5.rhaos4.11.git8bf967b.el8
cri-o-debugsource
Red Hat:openshift:4.11::el8
From an advisory covering 2 CVEs
 before 0:1.24.5-5.rhaos4.11.git8bf967b.el8
0:1.24.5-5.rhaos4.11.git8bf967b.el8
python-flask
Red Hat:openshift_ironic:4.11::el8
From an advisory covering 2 CVEs
 before 1:1.1.2-6.el8
1:1.1.2-6.el8
python-flask-doc
Red Hat:openshift_ironic:4.11::el8
From an advisory covering 2 CVEs
 before 1:1.1.2-6.el8
1:1.1.2-6.el8
python3-flask
Red Hat:openshift_ironic:4.11::el8
From an advisory covering 2 CVEs
 before 1:1.1.2-6.el8
1:1.1.2-6.el8
podman
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-catatonit
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-catatonit-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-debugsource
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-docker
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-gvproxy
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-gvproxy-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-plugins
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-plugins-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-remote
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-remote-debuginfo
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
podman-tests
Red Hat:openshift:4.12::el8
From an advisory covering 2 CVEs
 before 3:4.2.0-4.1.rhaos4.12.el8
3:4.2.0-4.1.rhaos4.12.el8
python-flask
Red Hat:openshift_ironic:4.12::el9
From an advisory covering 2 CVEs
 before 1:2.0.1-3.el9
1:2.0.1-3.el9
python-flask-doc
Red Hat:openshift_ironic:4.12::el9
From an advisory covering 2 CVEs
 before 1:2.0.1-3.el9
1:2.0.1-3.el9
python3-flask
Red Hat:openshift_ironic:4.12::el9
From an advisory covering 2 CVEs
 before 1:2.0.1-3.el9
1:2.0.1-3.el9
Flask
Root:PyPI
 before 2.1.2+aikido.2
2.1.2+aikido.22.1.2+aikido.32.1.2+aikido.4
rootio-Flask
Root:PyPI
 before 2.1.2+root.io.1
2.1.2+root.io.12.1.2+root.io.2
python-Flask
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 1.0.4-150400.3.3.1
1.0.4-150400.3.3.1
python-Flask
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 1.0.4-150400.3.3.1
1.0.4-150400.3.3.1
python-Flask
openSUSE:Leap 15.4
 before 1.0.4-150400.3.3.1
1.0.4-150400.3.3.1
python-Flask
openSUSE:Leap 15.5
 before 1.0.4-150400.3.3.1
1.0.4-150400.3.3.1
python-Flask
SUSE:Linux Enterprise Module for Package Hub 15 SP4
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Real Time 15 SP3
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Manager Proxy 4.2
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Manager Server 4.2
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Enterprise Storage 7
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
python-Flask
SUSE:Enterprise Storage 7.1
 before 1.0.2-150100.6.3.1
1.0.2-150100.6.3.1
flask
Ubuntu:20.04:LTS
 before 1.1.1-2ubuntu0.1, plus listed versions
1.0.2-31.1.1-2
1.1.1-2ubuntu0.1
flask
Ubuntu:22.04:LTS
 before 2.0.1-2ubuntu1.1, plus listed versions
1.1.2-22.0.1-2ubuntu1
2.0.1-2ubuntu1.1
python-Flask
openSUSE:Tumbleweed
 before 3.1.3-3.1
3.1.3-3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubfromitive/cve-2023-30861-poc2025-04-25
PoC in GitHubelisapresciutti/CVE-2023-30861-flask-lab2026-11-01

History

History
RecordedChangedSources
affected
exploits, factsOSV
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30861 is a high vulnerability (CVSS 7.5) in Pallets Flask, published May 1, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in flask 2.3.2.

References

Show 75 moreShow less
This page doesn't list everything

Left out here: 3 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open