Lucene search
PRIOn knowledge basePRION:CVE-2021-23385HistoryAug 02, 2022 - 2:15 p.m.
Input validation
2022-08-0214:15:00
PRIOn knowledge base
www.prio-n.com
4
This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. Note: Flask-Security is not maintained anymore.
Related
cve
cve
CVE-2021-23385
2022-08-02 14:15:10
ubuntucve
ubuntucve
CVE-2021-23385
2022-08-02 00:00:00
CVE-2021-32618
2021-05-17 00:00:00
nessus
nessus
Debian DLA-3545-1 : flask-security - LTS security update
2023-08-28 00:00:00
openSUSE 15 Security Update : python-Flask-Security (SUSE-SU-2022:3834-1)
2023-01-20 00:00:00
cvelist
cvelist
CVE-2021-23385 Open Redirect
2022-08-02 00:00:00
github
github
Flask-Security vulnerable to Open Redirect
2022-10-07 07:29:01
suse
suse
Security update for python-Flask-Security (moderate)
2022-11-01 00:00:00
Security update for python-Flask-Security-Too (moderate)
2022-11-03 00:00:00
gitlab
gitlab
URL Redirection to Untrusted Site ('Open Redirect')
2022-10-07 00:00:00
osv
osv
flask-security - security update
2023-08-28 00:00:00
Flask-Security vulnerable to Open Redirect
2022-10-07 07:29:01
flask-security vulnerability
2024-05-28 16:08:11
freebsd
freebsd
py-flask-security -- user redirect to arbitrary URL vulnerability
2022-08-02 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0105)
2023-03-28 00:00:00
Debian: Security Advisory (DLA-3545-1)
2023-08-29 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:3867-1)
2022-11-04 00:00:00
ubuntu
ubuntu
Flask-Security vulnerability
2024-05-28 00:00:00
debiancve
debiancve
CVE-2021-23385
2022-08-02 14:15:10
mageia
mageia
Updated python-flask-security packages fix security vulnerability
2023-03-24 08:55:49
debian
debian
[SECURITY] [DLA 3545-1] flask-security security update
2023-08-28 17:06:45
veracode
veracode
Open Redirect
2022-01-18 02:30:26
nvd
nvd
CVE-2021-23385
2022-08-02 14:15:10
thn
thn
Researchers Find Bugs in Over A Dozen Widely Used URL Parser Libraries
2022-01-10 14:35:00
threatpost
threatpost
URL Parsing-Library Bugs Allow DoS, RCE, Spoofing & More
2022-01-10 17:55:00