FKIE_CVE-2021-21241

Vulnerability from fkie_nvd - Published: 2021-01-11 21:15 - Updated: 2026-06-17 03:35
Severity
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
7.4 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Summary
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
References
security-advisories@github.comhttps://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1fPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542aPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/Flask-Middleware/flask-security/pull/422Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5Third Party Advisory
security-advisories@github.comhttps://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpvThird Party Advisory
security-advisories@github.comhttps://pypi.org/project/Flask-Security-TooProduct, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1fPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542aPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Flask-Middleware/flask-security/pull/422Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpvThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://pypi.org/project/Flask-Security-TooProduct, Third Party Advisory
Impacted products
Vendor Product Version
flask-security-too_project flask-security-too *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "flask-security-too",
          "vendor": "Flask-Middleware",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.3.0, \u003c 3.4.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6955F0BE-FEE7-4B0E-B488-FA537F6B068C",
              "versionEndExcluding": "3.4.5",
              "versionStartIncluding": "3.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user\u0027s authentication token in response to a GET request. Since GET requests aren\u0027t protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren\u0027t using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable."
    },
    {
      "lang": "es",
      "value": "El paquete Python \"Flask-Security-Too\" es usado para agregar funcionalidades de seguridad a su aplicaci\u00f3n Flask.\u0026#xa0;Es una versi\u00f3n mantenida independientemente de Flask-Security basada en la versi\u00f3n 3.0.0 de Flask-Security.\u0026#xa0;En Flask-Security-Too desde la versi\u00f3n 3.3.0 y versiones anteriores a 3.4.5, los endpoints /login y /change pueden devolver el token de autenticaci\u00f3n del usuario autenticado en respuesta a una petici\u00f3n GET.\u0026#xa0;Dado que las peticiones GET no est\u00e1n protegidas con un token CSRF, esto podr\u00eda conllevar a que un sitio de terceros malicioso adquiera el token de autenticaci\u00f3n.\u0026#xa0;La versi\u00f3n 3.4.5 y la versi\u00f3n 4.0.0 est\u00e1n parcheadas.\u0026#xa0;Como soluci\u00f3n temporal, si no est\u00e1 utilizando tokens de autenticaci\u00f3n, puede establecer el SECURITY_TOKEN_MAX_AGE en \"0\" (segundos), lo que deber\u00eda inutilizar el token"
    }
  ],
  "id": "CVE-2021-21241",
  "lastModified": "2026-06-17T03:35:06.603",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-01-11T21:15:13.377",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/pull/422"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "url": "https://pypi.org/project/Flask-Security-Too"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/commit/61d313150b5f620d0b800896c4f2199005e84b1f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/commit/6d50ee9169acf813257c37b75babe9c28e83542a"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/pull/422"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/releases/tag/3.4.5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security/security/advisories/GHSA-hh7m-rx4f-4vpv"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "url": "https://pypi.org/project/Flask-Security-Too"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.