CVE-2023-30861

A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions are met by the proxy’s behavior regarding cookies and the application’s behavior session usage: 1. The caching proxy does not strip or ignore response with cookies 2. The application sets a permanent session 3. The application does not access or modify the session during requests 4. SESSION_REFRESH_EACH_REQUEST is enabled, which is the default Flask behavior 5. The application does not set the Cache-Control header to avoid being cached