CVE-2022-25510: Hard coded credentials in FreeTAKServer

March 12, 2022 (updated November 26, 2024)

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.

References

github.com/FreeTAKTeam/FreeTakServer
github.com/FreeTAKTeam/FreeTakServer/issues/292
github.com/advisories/GHSA-f897-875p-23x7
github.com/pypa/advisory-database/tree/main/vulns/freetakserver/PYSEC-2022-43135.yaml
nvd.nist.gov/vuln/detail/CVE-2022-25510

Code Behaviors & Features

Detect and mitigate CVE-2022-25510 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →