CVE-2023-33175
Assigner: GitHub_M
Published: 2023-05-30T04:31:36.503Z
State: PUBLISHED
title: ToUI allows user-specific variables to be shared between users
problemTypes: descriptions: cweId: CWE-914
description: CWE-914: Improper Control of Dynamically-Identified Variables
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
affected: vendor: mubarakalmehairbi
product: ToUI
versions: version: >= 2.0.1, < 2.4.1
status: affected
descriptions: value: ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.
source: advisory: GHSA-hh7j-pg39-q563
discovery: UNKNOWN