Vulnerability · Published Jun 10, 2021 · Assigned by snyk
CVE-2021-23393Open Redirect
Medium 5.4
In plain English
A medium-severity security flaw in Flask-Unchained. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | flask-unchained | 0.9.0 | GHSA-pjc4-3w99-j7v4 |
| PyPI | flask-unchained | 0.9.0 | PYSEC-2021-96 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Flask-Unchained | unspecified – before 0.9.0 |