The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It
    is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-
    Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change
    endpoints can return the authenticated user's authentication token in response to a GET request. Since GET
    requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the
    authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using
    authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the
    token unusable. (CVE-2021-21241)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3093-1 advisory.

    - CVE-2021-21241: Fixed an issue where GET requests lacking CSRF       protection to certain endpoints could return the user's       authentication token (bsc#1181058).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
415752	SCA: security update for Flask-Security-Too (GHSA-hh7m-rx4f-4vpv)	Tenable Cloud Security	SCA Checks	Local	high
415752	SCA: security update for Flask-Security-Too (GHSA-hh7m-rx4f-4vpv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
164919	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Flask-Security-Too (SUSE-SU-2022:3093-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2021-21241

high

Tenable Plugins

high

high

high