CVE-2023-30861

A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions are met by the proxy's behavior regarding cookies and the application's behavior session usage:

1. The caching proxy does not strip or ignore response with cookies
2. The application sets a permanent session
3. The application does not access or modify the session during requests
4. SESSION_REFRESH_EACH_REQUEST is enabled, which is the default Flask behavior
5. The application does not set the Cache-Control header to avoid being cached

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.