From f7a4b030b6ae1f51ec32f572e195436c1b956aca Mon Sep 17 00:00:00 2001
From: "rfofspidernet.de (AIDA Special Comitee) = rfof-bitcoin.org - =
 rfofspidernet.de" <176731182+RFOF-NETWORK@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:03:37 +0200
Subject: [PATCH] Improve GHSA-m2qf-hxjv-5gpq

---
 .../05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json  | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json b/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json
index 5fb35d29394..ad032e3034f 100644
--- a/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json
+++ b/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m2qf-hxjv-5gpq",
-  "modified": "2024-09-20T17:51:00Z",
+  "modified": "2024-09-20T17:51:02Z",
   "published": "2023-05-01T19:22:20Z",
   "aliases": [
     "CVE-2023-30861"
@@ -9,20 +9,16 @@
   "summary": "Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header",
   "details": "When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by a proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session, and the proxy's behavior regarding cookies. The risk depends on _all_ these conditions being met.\n\n1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies.\n2. The application sets [`session.permanent = True`](https://flask.palletsprojects.com/en/2.3.x/api/#flask.session.permanent).\n2. The application does not access or modify the session at any point during a request.\n4. [`SESSION_REFRESH_EACH_REQUEST`](https://flask.palletsprojects.com/en/2.3.x/config/#SESSION_REFRESH_EACH_REQUEST) is enabled (the default).\n5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached.\n\nThis happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified.",
   "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
-    },
     {
       "type": "CVSS_V4",
-      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
+      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:H"
     }
   ],
   "affected": [
     {
       "package": {
         "ecosystem": "PyPI",
-        "name": "Flask"
+        "name": "flask"
       },
       "ranges": [
         {
@@ -41,7 +37,7 @@
     {
       "package": {
         "ecosystem": "PyPI",
-        "name": "Flask"
+        "name": "flask"
       },
       "ranges": [
         {