CVE-2021-23393

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
n/aFlask-Unchained>= unspecified, < 0.9.0

References

Timeline

Published
Jun 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-233949.8The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: CVE-2021-233955.3This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __prCVE-2021-233969.8All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.CVE-2021-233979.8All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @genCVE-2021-233986.1All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is trigCVE-2021-233999.8This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for aCVE-2021-23402.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Memcached). Supported versions that are affected are 8.0.25 anCVE-2021-234008.8The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriageCVE-2021-234016.1This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirectCVE-2021-234029.8All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.CVE-2021-234039.8All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.CVE-2021-234048.8This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the
CVE-2021-23393: Medium severity, CVSS 5.4 | Vulnix