CVE-2021-21241

Katalog CVE

CVSS 7.4 · High EPSS 0,93%

Kerentanan Cross-Site Request Forgery (CSRF) pada flask-security-too project flask-security-too. Skor CVSS 3.1 7.4 (High) menurut NVD.

Deskripsi (NVD)

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.

Rincian

Terbit di NVD

11 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,93% peluang dieksploitasi; lebih tinggi dari 59,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f patch · advisory pihak ketiga
• https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a patch · advisory pihak ketiga
• https://github.com/Flask-Middleware/flask-security/pull/422 patch · advisory pihak ketiga
• https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5 advisory pihak ketiga
• https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv advisory pihak ketiga
• https://pypi.org/project/Flask-Security-Too product · advisory pihak ketiga