Description (CNA)
changedetection.io is a free open source web page change detection tool. Prior to 0.54.8, the @login_optionally_required decorator is placed before (outer to) @blueprint.route() instead of after it. In Flask, @route() must be the outermost decorator because it registers the function it receives. When the order is reversed, @route() registers the original undecorated function, and the auth wrapper is never in the call chain. This silently disables authentication on these routes. This vulnerability is fixed in 0.54.8.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dgtlmoon / changedetection.io | affected < 0.54.8 |
CWE
CWE-863
References
ADP enrichment
No English description supplied.