Unauthenticated Flask Config Exposure in pyLoad

CVE-2024-21644

Summary

A vulnerability exists in the pyLoad Download Manager, a well-known open-source application developed in Python. This flaw enables any unauthenticated user to access a specific URL, which can expose critical Flask configuration information. This includes the sensitive SECRET_KEY variable, which is crucial for maintaining the integrity and security of the application. This vulnerability has been addressed in version 0.5.0b3.dev77, highlighting the necessity for users to update their installations to mitigate potential security risks.

References