2 lines
5.8 KiB
JSON
2 lines
5.8 KiB
JSON
{"affected":[{"affectedData":[{"product":"flask-security-too","vendor":"Flask-Middleware","versions":[{"status":"affected","version":">= 3.3.0, < 3.4.5"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*","matchCriteriaId":"6955F0BE-FEE7-4B0E-B488-FA537F6B068C","versionEndExcluding":"3.4.5","versionStartIncluding":"3.3.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable."},{"lang":"es","value":"El paquete Python \"Flask-Security-Too\" es usado para agregar funcionalidades de seguridad a su aplicación Flask. Es una versión mantenida independientemente de Flask-Security basada en la versión 3.0.0 de Flask-Security. En Flask-Security-Too desde la versión 3.3.0 y versiones anteriores a 3.4.5, los endpoints /login y /change pueden devolver el token de autenticación del usuario autenticado en respuesta a una petición GET. Dado que las peticiones GET no están protegidas con un token CSRF, esto podría conllevar a que un sitio de terceros malicioso adquiera el token de autenticación. La versión 3.4.5 y la versión 4.0.0 están parcheadas. Como solución temporal, si no está utilizando tokens de autenticación, puede establecer el SECURITY_TOKEN_MAX_AGE en \"0\" (segundos), lo que debería inutilizar el token"}],"id":"CVE-2021-21241","lastModified":"2026-06-17T03:35:06.603","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":4.3,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":true}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2021-01-11T21:15:13.377","references":[{"source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f"},{"source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a"},{"source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/pull/422"},{"source":"security-advisories@github.com","tags":["Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5"},{"source":"security-advisories@github.com","tags":["Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv"},{"source":"security-advisories@github.com","tags":["Product","Third Party Advisory"],"url":"https://pypi.org/project/Flask-Security-Too"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/pull/422"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product","Third Party Advisory"],"url":"https://pypi.org/project/Flask-Security-Too"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-352"}],"source":"security-advisories@github.com","type":"Secondary"}]}
|