4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
46.4%
Severity: High
Date : 2021-05-19
CVE-ID : CVE-2021-21241
Package : python-flask-security-too
Type : cross-site request forgery
Remote : Yes
Link : https://security.archlinux.org/AVG-1434
The package python-flask-security-too before version 4.0.1-1 is
vulnerable to cross-site request forgery.
Upgrade to 4.0.1-1.
The problem has been fixed upstream in version 4.0.1.
If you aren’t using authentication tokens, you can set
SECURITY_TOKEN_MAX_AGE to “0” (seconds) which should make the token
unusable.
In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the
/login and /change endpoints can return the authenticated user’s
authentication token in response to a GET request. Since GET requests
aren’t protected with a CSRF token, this could lead to a malicious 3rd
party site acquiring the authentication token. Version 3.4.5 and
version 4.0.0 are patched. As a workaround, if you aren’t using
authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to “0”
(seconds) which should make the token unusable.
A remote attacker could obtain a user’s authentication token from a
cross-site request.
https://bugs.archlinux.org/task/70041
https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
https://github.com/Flask-Middleware/flask-security/issues/421
https://github.com/Flask-Middleware/flask-security/pull/422
https://github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f59c0fb409ce1240341d1ec41
https://security.archlinux.org/CVE-2021-21241
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | python-flask-security-too | < 4.0.1-1 | UNKNOWN |
bugs.archlinux.org/task/70041
github.com/Flask-Middleware/flask-security/commit/c05afe837e83f20f59c0fb409ce1240341d1ec41
github.com/Flask-Middleware/flask-security/issues/421
github.com/Flask-Middleware/flask-security/pull/422
github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
security.archlinux.org/AVG-1434
security.archlinux.org/CVE-2021-21241
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
46.4%