CVE-2021-23401 — MEDIUM (5.4)

Vulnerability Description

This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Flask-User Project	Flask-User	All versions

Related Weaknesses (CWE)

CWE-601

References

https://github.com/lingthio/Flask-UserProductThird Party Advisory
https://github.com/lingthio/Flask-User/blob/master/flask_user/user_manager__utilExploitThird Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-FLASKUSER-1293188Third Party Advisory
https://github.com/lingthio/Flask-UserProductThird Party Advisory
https://github.com/lingthio/Flask-User/blob/master/flask_user/user_manager__utilExploitThird Party Advisory
https://snyk.io/vuln/SNYK-PYTHON-FLASKUSER-1293188Third Party Advisory

FAQ

What is CVE-2021-23401?

CVE-2021-23401 is a vulnerability with a CVSS score of 5.4 (MEDIUM). This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slash...

How severe is CVE-2021-23401?

CVE-2021-23401 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-23401?

Check the references section above for vendor advisories and patch information. Affected products include: Flask-User Project Flask-User.