| शीर्षक | cemtan sar2html 4.0.0 Hardcoded Credentials |
|---|
| विवरण | sar2html 4.0.0 contains a hardcoded Flask SECRET_KEY directly
in the application source code (sar2html.py, line 350):
app.config['SECRET_KEY'] = 'sar209@dnmduf8!23jQa'
The SECRET_KEY is used by Flask to cryptographically sign session
cookies. Any attacker with read access to the public repository
can retrieve this value and use it to forge valid session cookies
for any user account, effectively bypassing session-based
authentication controls.
The key is static across all deployments that use the default
source code without modification, meaning all default installations
share the same compromised secret.
Affected component: sar2html.py, line 350
Attack vector: Network
Privileges required: None
User interaction: None
CWE: CWE-798 (Use of Hard-coded Credentials)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
|---|
| स्रोत | ⚠️ https://github.com/cemtan/sar2html/issues/19 |
|---|
| उपयोगकर्ता | spoo1k (UID 101695) |
|---|
| सबमिशन | 28/09/2026 10:49 AM (19 दिन पहले) |
|---|
| संयम | 14/10/2026 03:11 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 419827 [cemtan sar2html 4.0.0 sar2html.py SECRET_KEY कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|