flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Flask-session-captcha Project |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-0105 | flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work. |
 Github GHSA |
GHSA-7r87-cj48-wj45 | Potential Captcha Validate Bypass in flask-session-captcha |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 23 Apr 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-04-23T18:32:31.559Z
Reserved: 2022-02-10T00:00:00.000Z
Link: CVE-2022-24880
Vulnrichment
Updated: 2024-08-03T04:29:00.717Z
NVD
Status : Modified
Published: 2022-04-25T22:15:43.883
Modified: 2024-11-21T06:51:18.540
Link: CVE-2022-24880
Redhat
No data.
OpenCVE Enrichment
No data.