Information Disclosure

2021-01-1206:22:13

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

46.4%

JSON

flask-security-too is vulnerable to information disclosure. The /login and /change endpoints return the authenticated user’s authentication token when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the authentication token.

CPENameOperatorVersion
flask-security-toole3.4.4

CPE	Name	Operator	Version
	flask-security-too	le	3.4.4

References

github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f

github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a

github.com/Flask-Middleware/flask-security/issues/421

github.com/Flask-Middleware/flask-security/pull/422

github.com/Flask-Middleware/flask-security/releases/tag/3.4.5

github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv

pypi.org/project/Flask-Security-Too

0.001 Low

EPSS

Percentile

46.4%

JSON

Related for VERACODE:28969