medium6.1
CVE-2021-23385
Flask-Security vulnerable to Open Redirect
Impact
This affects all versions of package Flask-Security. When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`. **Note:** Flask-Security is not maintained anymore.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Flask-Security | <= 3.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flask-Security Project | Flask-Security | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/mattupstate/flask-security
- https://lists.debian.org/debian-lts-announce/2023/08/msg00034.html
- https://security.snyk.io/vuln/SNYK-PYTHON-FLASKSECURITY-1293234
- https://snyk.io/blog/url-confusion-vulnerabilities/
- https://github.com/advisories/GHSA-cg8c-gc2j-2wf7
- https://nvd.nist.gov/vuln/detail/CVE-2021-23385