GitHub Advisoryadvisory · PyPI

GHSA-hh7m-rx4f-4vpv CSRF can expose users authentication token

HIGH Published 2021-01-11 Modified 2024-09-20 Official page ↗
Aliases
CVE-2021-21241
Ecosystem
PyPI
Packages
Flask-Security-Too
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-352
Reviewed
2021-01-11

Affected packages

• PyPI Flask-Security-Too: >= 3.3.0, < 3.4.5 → fixed in 3.4.5

Description

Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Patches Version 3.4.5 and soon to be released 4.0.0 are patched. Workarounds If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. References None

Related

Alias · CVE (1)

  • CVE-2021-21241 The Python "Flask-Security-Too" package is used for adding security features to your Flask application. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References