{"api_version":"1","generated_at":"2026-07-23T12:29:43+00:00","cve":"CVE-2022-24880","urls":{"html":"https://cve.report/CVE-2022-24880","api":"https://cve.report/api/cve/CVE-2022-24880.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-24880","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-24880"},"summary":{"title":"CVE-2022-24880","description":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-04-25 22:15:00","updated_at":"2022-05-05 18:20:00"},"problem_types":["CWE-754"],"metrics":[],"references":[{"url":"https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1","name":"https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1","refsource":"MISC","tags":[],"title":"Release v1.2.1 · Tethik/flask-session-captcha · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45","name":"https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45","refsource":"CONFIRM","tags":[],"title":"Potential Captcha Validate Bypass due to unexpected return value of validate-function · Advisory · Tethik/flask-session-captcha · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4","name":"https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4","refsource":"MISC","tags":[],"title":"add some extra tests to ensure False is returned · Tethik/flask-session-captcha@2811ae2 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/Tethik/flask-session-captcha/pull/27","name":"https://github.com/Tethik/flask-session-captcha/pull/27","refsource":"MISC","tags":[],"title":"Fix `validate()` returned value by GuillaumeGomez · Pull Request #27 · Tethik/flask-session-captcha · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24880","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24880","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"24880","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"flask-session-captcha_project","cpe5":"flask-session-captcha","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-24880","STATE":"PUBLIC","TITLE":"Potential Captcha Validate Bypass in flask-session-captcha"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"flask-session-captcha","version":{"version_data":[{"version_value":"< 1.2.1"}]}}]},"vendor_name":"Tethik"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an having an empty form). If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed. Version 1.2.1 fixes the issue. Users can workaround the issue by not explicitly checking that the value is False. Checking the return value less explicitly should still work."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-253: Incorrect Check of Function Return Value"}]},{"description":[{"lang":"eng","value":"CWE-394: Unexpected Status Code or Return Value"}]},{"description":[{"lang":"eng","value":"CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}]},"references":{"reference_data":[{"name":"https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45","refsource":"CONFIRM","url":"https://github.com/Tethik/flask-session-captcha/security/advisories/GHSA-7r87-cj48-wj45"},{"name":"https://github.com/Tethik/flask-session-captcha/pull/27","refsource":"MISC","url":"https://github.com/Tethik/flask-session-captcha/pull/27"},{"name":"https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4","refsource":"MISC","url":"https://github.com/Tethik/flask-session-captcha/commit/2811ae23a38d33b620fb7a07de8837c6d65c13e4"},{"name":"https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1","refsource":"MISC","url":"https://github.com/Tethik/flask-session-captcha/releases/tag/v1.2.1"}]},"source":{"advisory":"GHSA-7r87-cj48-wj45","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-04-25 22:15:00","lastModifiedDate":"2022-05-05 18:20:00","problem_types":["CWE-754"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:flask-session-captcha_project:flask-session-captcha:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.1","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"24880","Ordinal":"228315","Title":"CVE-2022-24880","CVE":"CVE-2022-24880","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"24880","Ordinal":"1","NoteData":"** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.","Type":"Description","Title":null}]}}}