Tóm tắt nhanh
- CVE-2021-21241 là lỗ hổng mức CAO (CVSS 7.4) ảnh hưởng flask-security-too, flask-security-too (flask-security-too project).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.93%, cao hơn 60.7% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 3.4.5 hoặc mới hơn.
Mô tả
Issue
The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.
Patches
Version 3.4.5 and soon to be released 4.0.0 are patched.
Workarounds
If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
References
None
Mô tả của NVD
The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí