CVE-2021-23401 impacts all versions of the Flask-User package, allowing an attacker to bypass URL validation in the make_safe_url function and redirect users to arbitrary URLs using multiple backslashes. This medium-severity vulnerability (CVSS 6.1) requires specific server configurations (non-Werkzeug WSGI or modified Werkzeug settings) to be exploitable, leading to potential information disclosure and integrity impacts. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:a:flask-user_project:flask-user:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.