Low severityNVD Advisory· Published Mar 3, 2025· Updated Mar 3, 2025

Observable Response Discrepancy in flask-appbuilder

CVE-2025-24023

Description

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
flask-appbuilderPyPI	< 4.5.3	4.5.3

Affected products

osv-coords9 versions
pkg:apk/chainguard/superset pkg:apk/chainguard/superset-ci pkg:apk/chainguard/superset-entrypoint pkg:apk/chainguard/superset-iamguarded-compat pkg:apk/wolfi/superset pkg:apk/wolfi/superset-ci pkg:apk/wolfi/superset-entrypoint pkg:apk/wolfi/superset-iamguarded-compat pkg:pypi/flask-appbuilder
< 4.1.1-r7+ 8 more
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.1.1-r7
- (no CPE)range: < 4.5.3
Dpgaspar/Flask Appbuilderv5
Range: < 4.5.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-p8q5-cvwx-wvwpghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-24023ghsaADVISORY
github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwpghsax_refsource_CONFIRMWEB
github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2025-15.yamlghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000