CVE catalog

CVE-2021-23385

flask-security: CVE-2021-23385

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.25% · Oct 25, 2026

This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. **Note:** Flask-Security is not maintained anymore.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianflask-securitysid5.9.1-1fixed
Debianflask-securityforky5.9.1-1fixed
Debianflask-securitytrixie5.6.1-1fixed
Debianflask-securitybookworm5.1.2-1fixed
Ubuntuflask-securitypro1.7.5-1vulnerable
Ubuntuflask-securitypro1.7.5-2vulnerable
Ubuntuflask-securitypro1.7.5-2ubuntu0.18.04.1~esm1fixed
Ubuntuflask-security20.041.7.5-2vulnerable
Ubuntuflask-security20.041.7.5-2ubuntu0.20.04.1fixed
Ubuntuflask-security22.044.0.0-1vulnerable
Ubuntuflask-security22.044.0.0-1ubuntu0.1fixed
Susepython-Flask-Security-Toolinux enterprise module for basesystem 15 sp33.4.2-150200.3.6.1fixed
Susepython-Flask-Security-Toolinux enterprise module for basesystem 15 sp43.4.2-150200.3.6.1fixed
Opensusepython-Flask-Security-Tooleap 15.33.4.2-150200.3.6.1fixed
Opensusepython-Flask-Security-Tooleap 15.43.4.2-150200.3.6.1fixed
Opensusepython-Flask-Securityleap 15.33.0.0-150100.4.3.1fixed
Opensusepython-Flask-Securityleap 15.43.0.0-150100.4.3.1fixed
Ubuntuflask-securitypro1.7.5-1vulnerable
Ubuntuflask-securitypro1.7.5-2vulnerable
Ubuntuflask-securitypro1.7.5-2ubuntu0.18.04.1~esm1fixed
Ubuntuflask-security20.041.7.5-2vulnerable
Ubuntuflask-security20.041.7.5-2ubuntu0.20.04.1fixed
Ubuntuflask-security22.044.0.0-1vulnerable
Ubuntuflask-security22.044.0.0-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianflask-securitysourcesid5.0.2-1not yet assignedNot reported[1021279]
Debianflask-securitysourceforky5.0.2-1not yet assignedNot reported[1021279]
Debianflask-securitysourcetrixie5.0.2-1not yet assignedNot reported[1021279]
Debianflask-securitysourcebookworm5.0.2-1not yet assignedNot reported[1021279]
Ubuntuflask-securitydebpro1.7.5-2ubuntu0.18.04.1~esm1Not reportedUSN-6792-1Not reported
Ubuntuflask-securitydeb20.041.7.5-2ubuntu0.20.04.1Not reportedUSN-6792-1Not reported
Ubuntuflask-securitydeb22.044.0.0-1ubuntu0.1Not reportedUSN-6792-1Not reported
Susepython-Flask-Security-Toorpmlinux enterprise module for basesystem 15 sp33.4.2-150200.3.6.1Not reportedSUSE-SU-2022:3867-1Not reported
Susepython-Flask-Security-Toorpmlinux enterprise module for basesystem 15 sp43.4.2-150200.3.6.1Not reportedSUSE-SU-2022:3867-1Not reported
Opensusepython-Flask-Security-Toorpmleap 15.33.4.2-150200.3.6.1Not reportedSUSE-SU-2022:3867-1Not reported
Opensusepython-Flask-Security-Toorpmleap 15.43.4.2-150200.3.6.1Not reportedSUSE-SU-2022:3867-1Not reported
Opensusepython-Flask-Securityrpmleap 15.33.0.0-150100.4.3.1Not reportedSUSE-SU-2022:3834-1Not reported
Opensusepython-Flask-Securityrpmleap 15.43.0.0-150100.4.3.1Not reportedSUSE-SU-2022:3834-1Not reported
Ubuntuflask-securitydebpro1.7.5-2ubuntu0.18.04.1~esm1Not reportedUBUNTU-CVE-2021-23385Not reported
Ubuntuflask-securitydeb20.041.7.5-2ubuntu0.20.04.1Not reportedUBUNTU-CVE-2021-23385Not reported
Ubuntuflask-securitydeb22.044.0.0-1ubuntu0.1Not reportedUBUNTU-CVE-2021-23385Not reported

[Debian bug #1021279]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-flask-security]Fixed

    Source package: [flask-security]

    Details (2)

    • 5.1.2-1 · all · bookworm

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12

    • 5.1.2-1 · all · bookworm

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12

  • [python-flask-security-doc]Fixed

    Source package: [flask-security]

    Details (2)

    • 5.1.2-1 · all · bookworm

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12

    • 5.1.2-1 · all · bookworm

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · bookworm; dsa · flask-security · debian · 12

[Debian 13 (Trixie)]

  • [python3-flask-security]Fixed

    Source package: [flask-security]

    Details (2)

    • 5.6.1-1 · all · trixie

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · 13

    • 5.6.1-1 · all · trixie

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · 13

  • [python-flask-security-doc]Fixed

    Source package: [flask-security]

    Details (2)

    • 5.6.1-1 · all · trixie

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · 13

    • 5.6.1-1 · all · trixie

      Fixed · Fixed: 5.0.2-1

      dsa · flask-security · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]