CVE-2023-33175 - Vulnerability Details - OpenCVE

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Toui Project	Toui

Configuration 1 [-]

cpe:2.3:a:toui_project:toui:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1
https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563

History

Fri, 10 Jan 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-05-30T04:31:36.503Z

Updated: 2025-01-10T20:35:07.109Z

Reserved: 2023-05-17T22:25:50.696Z

Link: CVE-2023-33175

Vulnrichment

Updated: 2024-08-02T15:39:35.714Z

NVD

Status : Modified

Published: 2023-05-30T05:15:11.877

Modified: 2024-11-21T08:05:03.017

Link: CVE-2023-33175

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33175", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-17T22:25:50.696Z", "datePublished": "2023-05-30T04:31:36.503Z", "dateUpdated": "2025-01-10T20:35:07.109Z"}, "containers": {"cna": {"title": "ToUI allows user-specific variables to be shared between users", "problemTypes": [{"descriptions": [{"cweId": "CWE-914", "lang": "en", "description": "CWE-914: Improper Control of Dynamically-Identified Variables", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"}, {"name": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"}], "affected": [{"vendor": "mubarakalmehairbi", "product": "ToUI", "versions": [{"version": ">= 2.0.1, < 2.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-30T04:31:36.503Z"}, "descriptions": [{"lang": "en", "value": "ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1."}], "source": {"advisory": "GHSA-hh7j-pg39-q563", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:35.714Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"}, {"name": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-10T20:34:59.010808Z", "id": "CVE-2023-33175", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T20:35:07.109Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-33175", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-05-17T22:25:50.696Z", "datePublished": "2023-05-30T04:31:36.503Z", "dateUpdated": "2025-01-10T20:35:07.109Z"}, "containers": {"cna": {"title": "ToUI allows user-specific variables to be shared between users", "problemTypes": [{"descriptions": [{"cweId": "CWE-914", "lang": "en", "description": "CWE-914: Improper Control of Dynamically-Identified Variables", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"}, {"name": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"}], "affected": [{"vendor": "mubarakalmehairbi", "product": "ToUI", "versions": [{"version": ">= 2.0.1, < 2.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-05-30T04:31:36.503Z"}, "descriptions": [{"lang": "en", "value": "ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1."}], "source": {"advisory": "GHSA-hh7j-pg39-q563", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T15:39:35.714Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"}, {"name": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-33175", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-10T20:34:59.010808Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-10T20:35:03.570Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:toui_project:toui:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C14F24C-0F44-472D-A3CE-16C78C907A2D", "versionEndIncluding": "2.4.0", "versionStartIncluding": "2.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1."}], "id": "CVE-2023-33175", "lastModified": "2024-11-21T08:05:03.017", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-05-30T05:15:11.877", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-914"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-913"}], "source": "nvd@nist.gov", "type": "Primary"}]}