CVE-2023-25392: Allegro Tech BigFlow vulnerable to… – CVSS 5.9 · Watchpost

← All vulnerabilities

Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation

中危 5.9CVE-2023-25392 · GHSA-w6q2-48ch-fj26 · PYSEC-2026-1220 · Published 10/04/2023 · updated 23/10/2026

要点

CVE-2023-25392 是影响 bigflow, bigflow (allegro) 的中危 (CVSS 5.9)漏洞。
未来 30 天内被利用的概率（EPSS）：0.43%，高于 37.8% 的漏洞。
修复：升级到 1.6.0, 1.6 或更高版本。

Package	Affected versions	Patched versions
bigflow PyPI	`< 1.6.0`	`1.6.0`
bigflow allegro	`< 1.6`	`1.6`

Description

Allegro Tech BigFlow prior to 1.6.0 is vulnerable to Missing SSL Certificate Validation.

NVD description

Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.

References

nvd.nist.gov/vuln/detail/CVE-2023-25392 · ADVISORY
allegro/bigflow#357 · WEB
allegro/bigflow commit 4ce197f · WEB
allegro/bigflow commit 7e95666 · WEB
allegro/bigflow · PACKAGE
lutrasecurity.com/en/articles/cve-2023-25392 · WEB
lutrasecurity.com/en/articles/cve-2023-25392 · Exploit
pypi.org/project/bigflow · PACKAGE
GitHub Advisory GHSA-w6q2-48ch-fj26 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free