CVE-2023-25392: Allegro Tech BigFlow vulnerable to… – CVSS 5.9 · Watchpost

← All vulnerabilities

Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation

보통 5.9CVE-2023-25392 · GHSA-w6q2-48ch-fj26 · PYSEC-2026-1220 · Published 10/04/2023 · updated 23/10/2026

요약

CVE-2023-25392은(는) bigflow, bigflow (allegro)에 영향을 주는 보통 (CVSS 5.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.43%, 전체 취약점의 37.8%보다 높음.
조치: 1.6.0, 1.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
bigflow PyPI	`< 1.6.0`	`1.6.0`
bigflow allegro	`< 1.6`	`1.6`

Description

Allegro Tech BigFlow prior to 1.6.0 is vulnerable to Missing SSL Certificate Validation.

NVD description

Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.

References

nvd.nist.gov/vuln/detail/CVE-2023-25392 · ADVISORY
allegro/bigflow#357 · WEB
allegro/bigflow commit 4ce197f · WEB
allegro/bigflow commit 7e95666 · WEB
allegro/bigflow · PACKAGE
lutrasecurity.com/en/articles/cve-2023-25392 · WEB
lutrasecurity.com/en/articles/cve-2023-25392 · Exploit
pypi.org/project/bigflow · PACKAGE
GitHub Advisory GHSA-w6q2-48ch-fj26 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free