by Kastro
Paper/Archive/CVE-2023-33175

CVE-2023-33175

mubarakalmehairbi ToUI — ToUI allows user-specific variables to be shared between users

EPSS 0.7%CVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 51.4.514 × 2010.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

Affected

ProductAffectedFixed inSource
ToUI>= 2.0.1, < 2.4.1–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563refgithub.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1