cvelistv5 - cve-2023-49438

CVE-2023-49438 (GCVE-0-2023-49438)

Vulnerability from cvelistv5 – Published: 2023-12-26 00:00 – Updated: 2025-11-04 18:19

Summary

An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

OPENSUSE-SU-2024:14555-1

Vulnerability from csaf_opensuse - Published: 2024-12-06 00:00 - Updated: 2024-12-06 00:00

Summary

python310-Flask-Security-5.5.2-1.1 on GA media

Notes

Title of the patch

python310-Flask-Security-5.5.2-1.1 on GA media

Description of the patch

These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-14555

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python310-Flask-Security-5.5.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python310-Flask-Security-5.5.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-14555",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_14555-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-21241 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-21241/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-23385 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-23385/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-49438 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-49438/"
      }
    ],
    "title": "python310-Flask-Security-5.5.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-12-06T00:00:00Z",
      "generator": {
        "date": "2024-12-06T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:14555-1",
      "initial_release_date": "2024-12-06T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-12-06T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-5.5.2-1.1.aarch64",
                "product": {
                  "name": "python310-Flask-Security-5.5.2-1.1.aarch64",
                  "product_id": "python310-Flask-Security-5.5.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-5.5.2-1.1.aarch64",
                "product": {
                  "name": "python311-Flask-Security-5.5.2-1.1.aarch64",
                  "product_id": "python311-Flask-Security-5.5.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-Flask-Security-5.5.2-1.1.aarch64",
                "product": {
                  "name": "python312-Flask-Security-5.5.2-1.1.aarch64",
                  "product_id": "python312-Flask-Security-5.5.2-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Flask-Security-5.5.2-1.1.aarch64",
                "product": {
                  "name": "python313-Flask-Security-5.5.2-1.1.aarch64",
                  "product_id": "python313-Flask-Security-5.5.2-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-5.5.2-1.1.ppc64le",
                "product": {
                  "name": "python310-Flask-Security-5.5.2-1.1.ppc64le",
                  "product_id": "python310-Flask-Security-5.5.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-5.5.2-1.1.ppc64le",
                "product": {
                  "name": "python311-Flask-Security-5.5.2-1.1.ppc64le",
                  "product_id": "python311-Flask-Security-5.5.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python312-Flask-Security-5.5.2-1.1.ppc64le",
                "product": {
                  "name": "python312-Flask-Security-5.5.2-1.1.ppc64le",
                  "product_id": "python312-Flask-Security-5.5.2-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Flask-Security-5.5.2-1.1.ppc64le",
                "product": {
                  "name": "python313-Flask-Security-5.5.2-1.1.ppc64le",
                  "product_id": "python313-Flask-Security-5.5.2-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-5.5.2-1.1.s390x",
                "product": {
                  "name": "python310-Flask-Security-5.5.2-1.1.s390x",
                  "product_id": "python310-Flask-Security-5.5.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-5.5.2-1.1.s390x",
                "product": {
                  "name": "python311-Flask-Security-5.5.2-1.1.s390x",
                  "product_id": "python311-Flask-Security-5.5.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python312-Flask-Security-5.5.2-1.1.s390x",
                "product": {
                  "name": "python312-Flask-Security-5.5.2-1.1.s390x",
                  "product_id": "python312-Flask-Security-5.5.2-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Flask-Security-5.5.2-1.1.s390x",
                "product": {
                  "name": "python313-Flask-Security-5.5.2-1.1.s390x",
                  "product_id": "python313-Flask-Security-5.5.2-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-5.5.2-1.1.x86_64",
                "product": {
                  "name": "python310-Flask-Security-5.5.2-1.1.x86_64",
                  "product_id": "python310-Flask-Security-5.5.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-5.5.2-1.1.x86_64",
                "product": {
                  "name": "python311-Flask-Security-5.5.2-1.1.x86_64",
                  "product_id": "python311-Flask-Security-5.5.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-Flask-Security-5.5.2-1.1.x86_64",
                "product": {
                  "name": "python312-Flask-Security-5.5.2-1.1.x86_64",
                  "product_id": "python312-Flask-Security-5.5.2-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-Flask-Security-5.5.2-1.1.x86_64",
                "product": {
                  "name": "python313-Flask-Security-5.5.2-1.1.x86_64",
                  "product_id": "python313-Flask-Security-5.5.2-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64"
        },
        "product_reference": "python310-Flask-Security-5.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le"
        },
        "product_reference": "python310-Flask-Security-5.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x"
        },
        "product_reference": "python310-Flask-Security-5.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64"
        },
        "product_reference": "python310-Flask-Security-5.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64"
        },
        "product_reference": "python311-Flask-Security-5.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le"
        },
        "product_reference": "python311-Flask-Security-5.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x"
        },
        "product_reference": "python311-Flask-Security-5.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64"
        },
        "product_reference": "python311-Flask-Security-5.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64"
        },
        "product_reference": "python312-Flask-Security-5.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le"
        },
        "product_reference": "python312-Flask-Security-5.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x"
        },
        "product_reference": "python312-Flask-Security-5.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64"
        },
        "product_reference": "python312-Flask-Security-5.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Flask-Security-5.5.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64"
        },
        "product_reference": "python313-Flask-Security-5.5.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Flask-Security-5.5.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le"
        },
        "product_reference": "python313-Flask-Security-5.5.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Flask-Security-5.5.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x"
        },
        "product_reference": "python313-Flask-Security-5.5.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-Flask-Security-5.5.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
        },
        "product_reference": "python313-Flask-Security-5.5.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-21241",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-21241"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user\u0027s authentication token in response to a GET request. Since GET requests aren\u0027t protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren\u0027t using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-21241",
          "url": "https://www.suse.com/security/cve/CVE-2021-21241"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1181058 for CVE-2021-21241",
          "url": "https://bugzilla.suse.com/1181058"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-06T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-21241"
    },
    {
      "cve": "CVE-2021-23385",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-23385"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using \u0027autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-23385",
          "url": "https://www.suse.com/security/cve/CVE-2021-23385"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1202105 for CVE-2021-23385",
          "url": "https://bugzilla.suse.com/1202105"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-23385"
    },
    {
      "cve": "CVE-2023-49438",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-49438"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
          "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-49438",
          "url": "https://www.suse.com/security/cve/CVE-2023-49438"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218412 for CVE-2023-49438",
          "url": "https://bugzilla.suse.com/1218412"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python312-Flask-Security-5.5.2-1.1.x86_64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.aarch64",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.s390x",
            "openSUSE Tumbleweed:python313-Flask-Security-5.5.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-12-06T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-49438"
    }
  ]
}

OPENSUSE-SU-2024:13563-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

python310-Flask-Security-Too-5.3.3-1.1 on GA media

Notes

Title of the patch

python310-Flask-Security-Too-5.3.3-1.1 on GA media

Description of the patch

These are all security issues fixed in the python310-Flask-Security-Too-5.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-13563

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python310-Flask-Security-Too-5.3.3-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python310-Flask-Security-Too-5.3.3-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13563",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13563-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-49438 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-49438/"
      }
    ],
    "title": "python310-Flask-Security-Too-5.3.3-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13563-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-Too-5.3.3-1.1.aarch64",
                "product": {
                  "name": "python310-Flask-Security-Too-5.3.3-1.1.aarch64",
                  "product_id": "python310-Flask-Security-Too-5.3.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-Too-5.3.3-1.1.aarch64",
                "product": {
                  "name": "python311-Flask-Security-Too-5.3.3-1.1.aarch64",
                  "product_id": "python311-Flask-Security-Too-5.3.3-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python39-Flask-Security-Too-5.3.3-1.1.aarch64",
                "product": {
                  "name": "python39-Flask-Security-Too-5.3.3-1.1.aarch64",
                  "product_id": "python39-Flask-Security-Too-5.3.3-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-Too-5.3.3-1.1.ppc64le",
                "product": {
                  "name": "python310-Flask-Security-Too-5.3.3-1.1.ppc64le",
                  "product_id": "python310-Flask-Security-Too-5.3.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-Too-5.3.3-1.1.ppc64le",
                "product": {
                  "name": "python311-Flask-Security-Too-5.3.3-1.1.ppc64le",
                  "product_id": "python311-Flask-Security-Too-5.3.3-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python39-Flask-Security-Too-5.3.3-1.1.ppc64le",
                "product": {
                  "name": "python39-Flask-Security-Too-5.3.3-1.1.ppc64le",
                  "product_id": "python39-Flask-Security-Too-5.3.3-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-Too-5.3.3-1.1.s390x",
                "product": {
                  "name": "python310-Flask-Security-Too-5.3.3-1.1.s390x",
                  "product_id": "python310-Flask-Security-Too-5.3.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-Too-5.3.3-1.1.s390x",
                "product": {
                  "name": "python311-Flask-Security-Too-5.3.3-1.1.s390x",
                  "product_id": "python311-Flask-Security-Too-5.3.3-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python39-Flask-Security-Too-5.3.3-1.1.s390x",
                "product": {
                  "name": "python39-Flask-Security-Too-5.3.3-1.1.s390x",
                  "product_id": "python39-Flask-Security-Too-5.3.3-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-Flask-Security-Too-5.3.3-1.1.x86_64",
                "product": {
                  "name": "python310-Flask-Security-Too-5.3.3-1.1.x86_64",
                  "product_id": "python310-Flask-Security-Too-5.3.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-Flask-Security-Too-5.3.3-1.1.x86_64",
                "product": {
                  "name": "python311-Flask-Security-Too-5.3.3-1.1.x86_64",
                  "product_id": "python311-Flask-Security-Too-5.3.3-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python39-Flask-Security-Too-5.3.3-1.1.x86_64",
                "product": {
                  "name": "python39-Flask-Security-Too-5.3.3-1.1.x86_64",
                  "product_id": "python39-Flask-Security-Too-5.3.3-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-Too-5.3.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.aarch64"
        },
        "product_reference": "python310-Flask-Security-Too-5.3.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-Too-5.3.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.ppc64le"
        },
        "product_reference": "python310-Flask-Security-Too-5.3.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-Too-5.3.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.s390x"
        },
        "product_reference": "python310-Flask-Security-Too-5.3.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-Flask-Security-Too-5.3.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.x86_64"
        },
        "product_reference": "python310-Flask-Security-Too-5.3.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-Too-5.3.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.aarch64"
        },
        "product_reference": "python311-Flask-Security-Too-5.3.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-Too-5.3.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.ppc64le"
        },
        "product_reference": "python311-Flask-Security-Too-5.3.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-Too-5.3.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.s390x"
        },
        "product_reference": "python311-Flask-Security-Too-5.3.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-Flask-Security-Too-5.3.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.x86_64"
        },
        "product_reference": "python311-Flask-Security-Too-5.3.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-Flask-Security-Too-5.3.3-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.aarch64"
        },
        "product_reference": "python39-Flask-Security-Too-5.3.3-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-Flask-Security-Too-5.3.3-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.ppc64le"
        },
        "product_reference": "python39-Flask-Security-Too-5.3.3-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-Flask-Security-Too-5.3.3-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.s390x"
        },
        "product_reference": "python39-Flask-Security-Too-5.3.3-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-Flask-Security-Too-5.3.3-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.x86_64"
        },
        "product_reference": "python39-Flask-Security-Too-5.3.3-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-49438",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-49438"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.aarch64",
          "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.s390x",
          "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.x86_64",
          "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.aarch64",
          "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.s390x",
          "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.x86_64",
          "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.aarch64",
          "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.ppc64le",
          "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.s390x",
          "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-49438",
          "url": "https://www.suse.com/security/cve/CVE-2023-49438"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1218412 for CVE-2023-49438",
          "url": "https://bugzilla.suse.com/1218412"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.x86_64",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.aarch64",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.s390x",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.aarch64",
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.s390x",
            "openSUSE Tumbleweed:python310-Flask-Security-Too-5.3.3-1.1.x86_64",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.aarch64",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.s390x",
            "openSUSE Tumbleweed:python311-Flask-Security-Too-5.3.3-1.1.x86_64",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.aarch64",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.ppc64le",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.s390x",
            "openSUSE Tumbleweed:python39-Flask-Security-Too-5.3.3-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-49438"
    }
  ]
}

PYSEC-2023-248

Vulnerability from pysec - Published: 2023-12-26 22:15 - Updated: 2024-01-17 11:19

Details

Severity ?

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Impacted products

Name	purl
flask-security-too	pkg:pypi/flask-security-too

Aliases

CVE-2023-49438

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "flask-security-too",
        "purl": "pkg:pypi/flask-security-too"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.1",
        "3.0.1rc1",
        "3.0.1rc2",
        "3.0.1rc3",
        "3.0.2",
        "3.1.0rc1",
        "3.2.0",
        "3.2.0rc1",
        "3.2.0rc3",
        "3.2.0rc4",
        "3.3.0",
        "3.3.0rc1",
        "3.3.0rc2",
        "3.3.0rc3",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.4.5",
        "4.0.0",
        "4.0.0rc1",
        "4.0.0rc2",
        "4.0.1",
        "4.1.0",
        "4.1.1",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "5.0.0",
        "5.0.1",
        "5.0.2",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.3.0",
        "5.3.1",
        "5.3.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49438"
  ],
  "details": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
  "id": "PYSEC-2023-248",
  "modified": "2024-01-17T11:19:18.188431+00:00",
  "published": "2023-12-26T22:15:00+00:00",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Flask-Middleware/flask-security"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2023-49438

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-49438

Aliases

CVE-2023-49438

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-49438",
    "id": "GSD-2023-49438"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-49438"
      ],
      "details": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
      "id": "GSD-2023-49438",
      "modified": "2023-12-13T01:20:35.115751Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-49438",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/Flask-Middleware/flask-security",
            "refsource": "MISC",
            "url": "https://github.com/Flask-Middleware/flask-security"
          },
          {
            "name": "https://github.com/brandon-t-elliott/CVE-2023-49438",
            "refsource": "MISC",
            "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
          },
          {
            "name": "FEDORA-2024-f34963bef8",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11C4D8B0-F35A-46FD-A848-799D45F5F7F0",
                    "versionEndIncluding": "5.3.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de redireccionamiento abierto en el paquete Python Flask-Security-Too \u0026lt;=5.3.2 permite a los atacantes redirigir a usuarios desprevenidos a sitios maliciosos a trav\u00e9s de una URL manipulada abusando del par\u00e1metro ?next en las rutas /login y /register."
          }
        ],
        "id": "CVE-2023-49438",
        "lastModified": "2024-01-14T02:15:46.610",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2023-12-26T22:15:13.973",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/Flask-Middleware/flask-security"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Mitigation",
              "Third Party Advisory"
            ],
            "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

FKIE_CVE-2023-49438

Vulnerability from fkie_nvd - Published: 2023-12-26 22:15 - Updated: 2025-11-04 19:16

Severity ?

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
cve@mitre.org	https://github.com/Flask-Middleware/flask-security	Product
cve@mitre.org	https://github.com/brandon-t-elliott/CVE-2023-49438	Exploit, Mitigation, Third Party Advisory
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/
af854a3a-2127-422b-91ae-364da2661108	https://github.com/Flask-Middleware/flask-security	Product
af854a3a-2127-422b-91ae-364da2661108	https://github.com/brandon-t-elliott/CVE-2023-49438	Exploit, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/

Impacted products

	Vendor	Product	Version
	flask-security-too_project	flask-security-too	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "11C4D8B0-F35A-46FD-A848-799D45F5F7F0",
              "versionEndIncluding": "5.3.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de redireccionamiento abierto en el paquete Python Flask-Security-Too \u0026lt;=5.3.2 permite a los atacantes redirigir a usuarios desprevenidos a sitios maliciosos a trav\u00e9s de una URL manipulada abusando del par\u00e1metro ?next en las rutas /login y /register."
    }
  ],
  "id": "CVE-2023-49438",
  "lastModified": "2025-11-04T19:16:09.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-12-26T22:15:13.973",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/Flask-Middleware/flask-security"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-672H-6X89-76M5

Vulnerability from github – Published: 2023-12-27 00:30 – Updated: 2024-09-20 17:51

Summary

Open redirect vulnerability in Flask-Security-Too

Details

Flask-Security-Too contains logic to validate that the URL specified within the next parameter is either relative or has the same network location as the requesting URL in an attempt to prevent open redirections. Previously known examples that bypassed the validation logic such as https://example/login?next=\\\\\\github.com were patched in version 4.1.0

However, examples such as https://example/login?next=/\\github.com and https://example/login?next=\\/github.com were discovered due to how web browsers normalize slashes in URLs, which makes the package vulnerable through version <=5.3.2

Additionally, with Werkzeug >=2.1.0 the autocorrect_location_header configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug >=2.1.0 as the WSGI layer.

Severity ?

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Flask-Security-Too"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-08T21:47:12Z",
    "nvd_published_at": "2023-12-26T22:15:13Z",
    "severity": "MODERATE"
  },
  "details": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.\n\nFlask-Security-Too contains logic to validate that the URL specified within the next parameter is either relative or has the same network location as the requesting URL in an attempt to prevent open redirections. Previously known examples that bypassed the validation logic such as `https://example/login?next=\\\\\\\\\\\\github.com` were patched in version 4.1.0\n\nHowever, examples such as `https://example/login?next=/\\\\github.com` and `https://example/login?next=\\\\/github.com` were discovered due to how web browsers normalize slashes in URLs, which makes the package vulnerable through version \u003c=5.3.2\n\nAdditionally, with Werkzeug \u003e=2.1.0 the autocorrect_location_header configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug \u003e=2.1.0 as the WSGI layer.",
  "id": "GHSA-672h-6x89-76m5",
  "modified": "2024-09-20T17:51:44Z",
  "published": "2023-12-27T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Flask-Middleware/flask-security/commit/8b5abc4d4db9926a3d76b34b8b03255effb5e712"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Flask-Middleware/flask-security"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/flask-security-too/PYSEC-2023-248.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Open redirect vulnerability in Flask-Security-Too"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2023-49438 (GCVE-0-2023-49438)

OPENSUSE-SU-2024:14555-1

OPENSUSE-SU-2024:13563-1

PYSEC-2023-248

GSD-2023-49438

FKIE_CVE-2023-49438

GHSA-672H-6X89-76M5

Tags

Sightings

Nomenclature