Flask-AppBuilder vulnerabilities

2 known vulnerabilities in Flask-AppBuilder from Dpgaspar. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Flask-AppBuilder: Improper Authentication

  CVE-2024-25128Feb 29, 2024Dpgaspar

  Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vu

• 7.5 High severity

  Flask-AppBuilder: Improper Restriction of Excessive Authentication Attempts

  CVE-2023-29005Apr 10, 2023Dpgaspar

  Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH