high8.8
CVE-2022-25510
Hard coded credentials in FreeTAKServer
Impact
FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | FreeTAKServer | <= 1.9.8 | 1.9.8.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Freetakserver-Ui Project | Freetakserver-Ui | Version 1.9.8 |