Moderate severityNVD Advisory· Published Feb 28, 2024· Updated Aug 8, 2024
Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
CVE-2024-27083
Description
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
Flask-AppBuilderPyPI | >= 4.1.4, < 4.2.1 | 4.2.1 |
Affected products
2- Range: >= 4.1.4, < 4.2.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-fqxj-46wg-9v84ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-27083ghsaADVISORY
- github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812ghsax_refsource_MISCWEB
- github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.