Security Resilience

CVE-2023-30861

Palletsprojects Flask ≤ 2.2.5

Published
02 May 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.013 69th percentile
Risk Priority 60 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-30861 is a high-severity Use of Persistent Cookies Containing Sensitive Information (CWE-539) vulnerability in Palletsprojects Flask. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked in the top 31% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also…

more

caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

CWE(s)
CWE-539

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-27205Same product: Palletsprojects Flask
CVE-2024-39275Shared CWE-539
CVE-2026-35192Shared CWE-539
CVE-2025-27673Shared CWE-539
CVE-2026-24318Shared CWE-539
CVE-2025-52633Shared CWE-539
CVE-2024-22195Same vendor: Palletsprojects
CVE-2024-56201Same vendor: Palletsprojects
CVE-2024-56326Same vendor: Palletsprojects
CVE-2026-7246Same vendor: Palletsprojects

Affected Assets

palletsprojects
flask
≤ 2.2.5 · 2.3.0 — 2.3.2

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices and coding standards directly prohibit storing sensitive data in persistent cookies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.34 Privacy and protection of PII partial match
degrades

Privacy and PII protection policies require safeguards against exposing sensitive data via cookies.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cookie lifetime and encryption policies.

A.8.10 Information deletion partial match
degrades

Information deletion policies can mandate removal or encryption of sensitive cookie data.

A.8.12 Data leakage prevention partial match
degrades

Data leakage prevention controls can block or encrypt sensitive information in cookies.

A.8.17 Clock synchronization partial match
removes
A.8.19 Installation of software on operational systems partial match
removes

References