In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15235
Reference (s):
- https://github.com/ractf/core/security/advisories/GHSA-ph67-c355-52vm
- URL: https://github.com/ractf/core/security/advisories/GHSA-ph67-c355-52vm
- https://github.com/ractf/core/commit/f3dc89b9f6ab1544a289b3efc06699b13d63e0bd
- URL: https://github.com/ractf/core/commit/f3dc89b9f6ab1544a289b3efc06699b13d63e0bd