taipy 中没有 Secure 和 HTTPOnly 标志的会话 Cookie (CVE-2024-47833)

CVE编号

CVE-2024-47833

利用情况

暂无

补丁情况

N/A

披露时间

2024-10-10

漏洞描述

Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/Avaiga/taipy/security/advisories/GHSA-r3jq-4r5c-j9hp

CVSS3评分 6.3

• 攻击路径 N/A
• 攻击复杂度 N/A
• 权限要求 N/A
• 影响范围 N/A
• 用户交互 N/A
• 可用性 N/A
• 保密性 N/A
• 完整性 N/A

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE-ID	漏洞类型
CWE-1004	没有'HttpOnly'标志的敏感Cookie
CWE-614	HTTPS会话中未设置'Secure'属性的敏感Cookie

Exp相关链接

- avd.aliyun.com