CVE-2021-21241
Summary
| CVE | CVE-2021-21241 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-01-11 21:15:00 UTC |
|---|
| Updated | 2021-01-19 15:43:00 UTC |
|---|
| Description | The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Fix security vuln - GET on /login or /change could reveal authenticat… · Flask-Middleware/flask-security@6d50ee9 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| Flask-Security-Too · PyPI |
MISC |
pypi.org |
Product, Third Party Advisory |
| Release Fix CSRF Vulnerability · Flask-Middleware/flask-security · GitHub |
MISC |
github.com |
Third Party Advisory |
| CSRF Vuln can expose users authentication token · Advisory · Flask-Middleware/flask-security · GitHub |
CONFIRM |
github.com |
Third Party Advisory |
| Fix security vuln - GET on /login or /change could reveal authenticat… by jwag956 · Pull Request #422 · Flask-Middleware/flask-security · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| I421backport (#425) · Flask-Middleware/flask-security@61d3131 · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179957 Debian Security Update for flask-security (CVE-2021-21241)
- 752549 SUSE Enterprise Linux Security Update for python-Flask-Security-Too (SUSE-SU-2022:3093-1)
- 983060 Python (pip) Security Update for Flask-Security-Too (GHSA-hh7m-rx4f-4vpv)
