GHSA-hh7j-pg39-q563CriticalCVSS 9.1

toui allows user-specific variables to be shared between users

Published
May 24, 2023
Last Modified
November 4, 2023

🔗 CVE IDs covered (1)

CVE-2023-33175 →

📋 Description

Impact

Websites that use Website.user_vars property in versions.

Patches

It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

Workarounds

Do not use Website.user_vars in websites when using versions v2.0.1 to v2.4.0. Also, do not use Website.signin_user() in version v2.4.0 only.

Explanation

ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.

🎯 Affected products1

  • pip/toui:>= 2.0.1, < 2.4.1

🔗 References (4)