GHSA-h6r2-pgvx-683c

Lin-CMS-Flask vulnerable to Improper Authentication

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-18698

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Lin-CMS	0.1.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component `app/api/cms/user.py`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-18698 advisory
https://github.com/TaleLin/lin-cms-flask/issues/27 web
https://cwe.mitre.org/data/definitions/307.html web
https://github.com/TaleLin/lin-cms-flask package
https://github.com/pypa/advisory-database/tree/main/vulns/lin-cms/PYSEC-2021-339.yaml web