CVE-2021-21241
Description
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
How to fix
- flask-security-too_project flask-security-too3.4.5 or later
- flask-security-too3.4.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flask-security-too_project flask-security-too | 3.3.0 ≤ v < 3.4.5 | 3.4.5 |
| flask-security-tooPyPI | 3.3.0 ≤ v < 3.4.5 | 3.4.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.