PYSEC-2021-96

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/flask-unchained/PYSEC-2021-96.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2021-96
Aliases
Published
2021-06-11T00:15:00Z
Modified
2023-11-01T04:54:37.127806Z
Summary
[none]
Details

This affects the package Flask-Unchained before 0.9.0. When using the the validateredirecturl function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrectlocation_header=False.

References

Affected packages

PyPI / flask-unchained

Package

Name
flask-unchained
View open source insights on deps.dev
Purl
pkg:pypi/flask-unchained

Affected ranges

Type
GIT
Repo
https://github.com/briancappello/flask-unchained
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
71e36b28166f9ffbe0a991f51127f0984f7e6a40
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.0

Affected versions

0.*

0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.4.0
0.4.1
0.4.2
0.5.0
0.5.1
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1