PYSEC-2021-337
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/flask-user/PYSEC-2021-337.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2021-337
- Aliases
-
- CVE-2021-23401
- GHSA-4298-89hc-6rfv
- SNYK-PYTHON-FLASKUSER-1293188
- Published
- 2021-07-05T11:15:00Z
- Modified
- 2023-11-08T04:05:07.511361Z
- Summary
- [none]
- Details
-
This affects all versions of package Flask-User. When using the makesafeurl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrectlocationheader=False.
- References
Affected packages
PyPI / flask-user
Package
- Name
- flask-user
- View open source insights on deps.dev
- Purl
- pkg:pypi/flask-user
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
0.*
0.3
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.6
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.6.10
0.6.12
0.6.13
0.6.14
0.6.15
0.6.16
0.6.17
0.6.19
0.6.20
0.6.21
1.*
1.0.1.1
1.0.1.2
1.0.1.3
1.0.1.4
1.0.1.5
1.0.2.0
1.0.2.1
1.0.2.2