{"action":"Upgrade flask to 2.2.5 or later.","affected":[{"fixed":"2.3.2","introduced":"2.3.0"},{"fixed":"2.2.5","introduced":"0"}],"component":"flask","cve_ids":["CVE-2023-30861"],"ecosystem":"PyPI","epss":0.0125,"exploited":false,"fixed_versions":["2.3.2","2.2.5"],"ghsa_id":"GHSA-m2qf-hxjv-5gpq","id":"tcs_01M5KFPYYDZXWGCRDQSH22YTXX","modified_at":"2026-09-10T03:50:01.763387498Z","published_at":"2023-05-01T19:22:20Z","references":["https://osv.dev/vulnerability/GHSA-m2qf-hxjv-5gpq","https://github.com/pallets/flask/security/advisories/GHSA-m2qf-hxjv-5gpq","https://nvd.nist.gov/vuln/detail/CVE-2023-30861","https://github.com/pallets/flask/commit/70f906c51ce49c485f1d355703e9cc3386b1cc2b","https://github.com/pallets/flask/commit/afd63b16170b7c047f5758eb910c416511e9c965","https://github.com/pallets/flask","https://github.com/pallets/flask/releases/tag/2.2.5","https://github.com/pallets/flask/releases/tag/2.3.2","https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2023-62.yaml","https://lists.debian.org/debian-lts-announce/2023/08/msg00024.html","https://security.netapp.com/advisory/ntap-20230818-0006","https://www.debian.org/security/2023/dsa-5442"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-m2qf-hxjv-5gpq","url":"https://osv.dev/vulnerability/GHSA-m2qf-hxjv-5gpq"}],"summary":"Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header"}