CVE-2023-49438

Nuclei

Open redirect vulnerability in Flask-Security-Too

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

EIP currently links 1 repository PoC and 1 Nuclei template to CVE-2023-49438.

Description

An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Flask-Security-Too

Browse PyPI / Flask-Security-Too
GitHub AdvisoryBefore 5.3.3 · Fixed in 5.3.3affected

Proofs of concept

1

Repository PoCs

GitHubbrandon-t-elliott/CVE-2023-49438Repository PoCby brandon-t-elliott5Not analyzed1 file

2.8 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMPython Flask-Security-Too <=5.3.2 - Open RedirectCVSS 6.1

An open redirect vulnerability exists in the python package Flask-Security-Too prior to version 5.3.3. Attackers can abuse the 'next' parameter on the /login and /register routes to redirect unsuspecting users to malicious sites via crafted URLs, which could lead to phishing or other attacks ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-49438)).

Impact

Allows attackers to redirect users to arbitrary sites, potentially leading to phishing, data theft, or user session hijacking.

Remediation

Upgrade Flask-Security-Too to version 5.3.3 or later to mitigate the open redirect vulnerability.

WeaknessesCWE-601
Authorsritikchaddha
Template tagscve2023cveredirectflaskflask-security
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:flask-security-too_project:flask-security-too:*:*:*:*:*:*:*:*
https://github.com/Flask-Middleware/flask-security https://github.com/brandon-t-elliott/CVE-2023-49438 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6HCYH377TPUMUHELPI36PDS2ZM4VFIXM/ https://nvd.nist.gov/vuln/detail/CVE-2023-49438

Source: ProjectDiscovery

References

7