TI-2024-32100 Aliases CVE-2024-47833 GHSA-r3jq-4r5c-j9hp

Session Cookie without Secure and HTTPOnly flags in taipy

MEDIUM 61CWE-1004Published 2024-10-09 · Updated 2024-10-09

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-319.

Summary

Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00252 16th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed taipy (Avaiga): 4.0.0taipy (PyPI): 4.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Avaiga	taipy	before 4.0.0	4.0.0	Patch available	CNA
—	taipy (PyPI)	before 4.0.0	4.0.0	Patch available	GHSA-r3jq-4r5c-j9hp

taipy VendorAvaiga Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
taipy (PyPI) Vendor— Affected before 4.0.0 Fixed in 4.0.0 Patch available GHSA-r3jq-4r5c-j9hp

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:avaiga:taipy::::::::	before 4.0.0	Vulnerable	Avaiga

cpe:2.3:a:avaiga:taipy:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·Avaiga

Remediation

Fix · CNA taipy (Avaiga) Fixed in 4.0.0
Fix · GHSA-r3jq-4r5c-j9hp taipy (PyPI) Fixed in 4.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-47833
2026-10-03 Alias added: GHSA-r3jq-4r5c-j9hp

References

Exploit 1

https://github.com/Avaiga/taipy/security/advisories/GHSA-r3jq-4r5c-j9hp

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-47833

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences