~ / search / GHSA-hh7m-rx4f-4vpv

GHSA-hh7m-rx4f-4vpv

CSRF can expose users authentication token

Source: GitHub Advisory Database (reviewed) High CVE-2021-21241

Packages

EcosystemPackageAffectedFixed in
PyPI Flask-Security-Too >= 3.3.0, < 3.4.5 3.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Issue The /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. ### Patches Version 3.4.5 and soon to be released 4.0.0 are patched. ### Workarounds If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable. ### References None

References

External links from the advisory. They lead to third-party sites.