4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
46.4%
The Python “Flask-Security-Too” package is used for adding security
features to your Flask application. It is an is a independently maintained
version of Flask-Security based on the 3.0.0 version of Flask-Security. In
Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login
and /change endpoints can return the authenticated user’s authentication
token in response to a GET request. Since GET requests aren’t protected
with a CSRF token, this could lead to a malicious 3rd party site acquiring
the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a
workaround, if you aren’t using authentication tokens - you can set the
SECURITY_TOKEN_MAX_AGE to “0” (seconds) which should make the token
unusable.
github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f
github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a
github.com/Flask-Middleware/flask-security/pull/422
github.com/Flask-Middleware/flask-security/releases/tag/3.4.5
github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv
launchpad.net/bugs/cve/CVE-2021-21241
nvd.nist.gov/vuln/detail/CVE-2021-21241
pypi.org/project/Flask-Security-Too
security-tracker.debian.org/tracker/CVE-2021-21241
www.cve.org/CVERecord?id=CVE-2021-21241
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
7.4 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
46.4%