Hard coded credentials in FreeTAKServer

ALTO 8.8CVE-2022-25510 · GHSA-f897-875p-23x7 · PYSEC-2022-43135 · Published 11/03/2022 · updated 17/06/2026

In breve

CVE-2022-25510 è una vulnerabilità ALTO (CVSS 8.8) che riguarda freetakserver, freetakserver-ui (freetakserver-ui project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.1%, superiore al 64.4% delle vulnerabilità.
Correzione: aggiornare a 1.9.8.5 o successiva.

Package	Affected versions	Patched versions
freetakserver PyPI	`< 1.9.8.5`	`1.9.8.5`
freetakserver-ui freetakserver-ui_project	`= 1.9.8`	No fix yet

Description

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.

NVD description

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.

References

nvd.nist.gov/vuln/detail/CVE-2022-25510 · ADVISORY
FreeTAKTeam/FreeTakServer · WEB
FreeTAKTeam/FreeTakServer · PACKAGE
pypa/advisory-database · WEB

Altre vulnerabilità di freetakserver

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free