{
  "GSD": {
    "alias": "CVE-2023-49438",
    "id": "GSD-2023-49438"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-49438"
      ],
      "details": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
      "id": "GSD-2023-49438",
      "modified": "2023-12-13T01:20:35.115751Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-49438",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/Flask-Middleware/flask-security",
            "refsource": "MISC",
            "url": "https://github.com/Flask-Middleware/flask-security"
          },
          {
            "name": "https://github.com/brandon-t-elliott/CVE-2023-49438",
            "refsource": "MISC",
            "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
          },
          {
            "name": "FEDORA-2024-f34963bef8",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "11C4D8B0-F35A-46FD-A848-799D45F5F7F0",
                    "versionEndIncluding": "5.3.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de redireccionamiento abierto en el paquete Python Flask-Security-Too \u0026lt;=5.3.2 permite a los atacantes redirigir a usuarios desprevenidos a sitios maliciosos a trav\u00e9s de una URL manipulada abusando del par\u00e1metro ?next en las rutas /login y /register."
          }
        ],
        "id": "CVE-2023-49438",
        "lastModified": "2024-01-14T02:15:46.610",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2023-12-26T22:15:13.973",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Product"
            ],
            "url": "https://github.com/Flask-Middleware/flask-security"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Mitigation",
              "Third Party Advisory"
            ],
            "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-601"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "flask-security-too",
        "purl": "pkg:pypi/flask-security-too"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.1",
        "3.0.1rc1",
        "3.0.1rc2",
        "3.0.1rc3",
        "3.0.2",
        "3.1.0rc1",
        "3.2.0",
        "3.2.0rc1",
        "3.2.0rc3",
        "3.2.0rc4",
        "3.3.0",
        "3.3.0rc1",
        "3.3.0rc2",
        "3.3.0rc3",
        "3.3.1",
        "3.3.2",
        "3.3.3",
        "3.4.0",
        "3.4.1",
        "3.4.2",
        "3.4.3",
        "3.4.4",
        "3.4.5",
        "4.0.0",
        "4.0.0rc1",
        "4.0.0rc2",
        "4.0.1",
        "4.1.0",
        "4.1.1",
        "4.1.2",
        "4.1.3",
        "4.1.4",
        "4.1.5",
        "4.1.6",
        "5.0.0",
        "5.0.1",
        "5.0.2",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.3.0",
        "5.3.1",
        "5.3.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49438"
  ],
  "details": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.",
  "id": "PYSEC-2023-248",
  "modified": "2024-01-17T11:19:18.188431+00:00",
  "published": "2023-12-26T22:15:00+00:00",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Flask-Middleware/flask-security"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Flask-Security-Too"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-49438"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-08T21:47:12Z",
    "nvd_published_at": "2023-12-26T22:15:13Z",
    "severity": "MODERATE"
  },
  "details": "An open redirect vulnerability in the python package Flask-Security-Too \u003c=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.\n\nFlask-Security-Too contains logic to validate that the URL specified within the next parameter is either relative or has the same network location as the requesting URL in an attempt to prevent open redirections. Previously known examples that bypassed the validation logic such as `https://example/login?next=\\\\\\\\\\\\github.com` were patched in version 4.1.0\n\nHowever, examples such as `https://example/login?next=/\\\\github.com` and `https://example/login?next=\\\\/github.com` were discovered due to how web browsers normalize slashes in URLs, which makes the package vulnerable through version \u003c=5.3.2\n\nAdditionally, with Werkzeug \u003e=2.1.0 the autocorrect_location_header configuration was changed to False - which means that location headers in redirects are relative by default. Thus, this issue may impact applications that were previously not impacted, if they are using Werkzeug \u003e=2.1.0 as the WSGI layer.",
  "id": "GHSA-672h-6x89-76m5",
  "modified": "2024-09-20T17:51:44Z",
  "published": "2023-12-27T00:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Flask-Middleware/flask-security/commit/8b5abc4d4db9926a3d76b34b8b03255effb5e712"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Flask-Middleware/flask-security"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brandon-t-elliott/CVE-2023-49438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/flask-security-too/PYSEC-2023-248.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Open redirect vulnerability in Flask-Security-Too"
}