CVE-2021-21241 — Cross-Site Request Forgery

Vendor	Product	Version range	Fixed in
debian	flask-security	< flask-security 4.0.0-1 (bookworm)	flask-security 4.0.0-1 (bookworm)
flask-middleware	flask-security-too	—	—
flask-security-too_project	flask-security-too	>= 3.3.0 < 3.4.5	3.4.5
flask-security-too_project	flask-security-too	>= 3.3.0 < 3.4.5	3.4.5

OSV

CSRF can expose users authentication token

osv·2021-01-11

CVE-2021-21241 [HIGH] CSRF can expose users authentication token CSRF can expose users authentication token ### Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. ### Patches Version 3.4.5 and soon to be released 4.0.0 are patched. ### Workarounds If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. ### References None

GHSA

CSRF can expose users authentication token

ghsa·2021-01-11

CVE-2021-21241 [HIGH] CWE-352 CSRF can expose users authentication token CSRF can expose users authentication token ### Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. ### Patches Version 3.4.5 and soon to be released 4.0.0 are patched. ### Workarounds If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. ### References None

OSV

CVE-2021-21241: The Python "Flask-Security-Too" package is used for adding security features to your Flask application

osv·2021-01-11·CVSS 7.4

CVE-2021-21241 [HIGH] CVE-2021-21241: The Python "Flask-Security-Too" package is used for adding security features to your Flask application The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.

Debian

CVE-2021-21241: flask-security - The Python "Flask-Security-Too" package is used for adding security features to ...

vendor_debian·2021·CVSS 7.4

CVE-2021-21241 [HIGH] CVE-2021-21241: flask-security - The Python "Flask-Security-Too" package is used for adding security features to ... The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. Scope: local bookworm: resolved (fixed in 4.0.0-1) bullseye:

CVE-2021-21241: The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of…

Affected

CVSS provenance