PyPI package
flask-appbuilder
pkg:pypi/flask-appbuilder
Vulnerabilities (14)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-58065 | — | < 4.8.1 | 4.8.1 | Sep 11, 2025 | Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in th | ||
| CVE-2025-32962 | — | < 4.6.2 | 4.6.2 | May 16, 2025 | Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_ | ||
| CVE-2025-24023 | — | < 4.5.3 | 4.5.3 | Mar 3, 2025 | Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3. | ||
| CVE-2024-45314 | — | < 4.5.1 | 4.5.1 | Sep 4, 2024 | Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch f | ||
| CVE-2024-27083 | — | >= 4.1.4, < 4.2.1 | 4.2.1 | Feb 28, 2024 | Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject | ||
| CVE-2024-25128 | — | < 4.3.11 | 4.3.11 | Feb 28, 2024 | Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could gr | ||
| CVE-2023-34110 | — | < 4.3.2 | 4.3.2 | Jun 22, 2023 | Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back t | ||
| CVE-2023-29005 | — | < 4.3.0 | 4.3.0 | Apr 10, 2023 | Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`. | ||
| CVE-2022-31177 | — | < 4.1.3 | 4.1.3 | Aug 1, 2022 | Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed passwo | ||
| CVE-2022-24776 | — | < 3.4.5 | 3.4.5 | Mar 24, 2022 | Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are curre | ||
| CVE-2022-21659 | — | < 3.4.4 | 3.4.4 | Jan 31, 2022 | Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time | ||
| CVE-2021-41265 | — | < 3.3.4 | 3.3.4 | Dec 9, 2021 | Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to exis | ||
| CVE-2021-32805 | — | < 3.3.2 | 3.3.2 | Sep 8, 2021 | Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user | ||
| CVE-2021-29621 | — | < 3.3.0 | 3.3.0 | Jun 7, 2021 | Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Up |
- CVE-2025-58065Sep 11, 2025affected < 4.8.1fixed 4.8.1
Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in th
- CVE-2025-32962May 16, 2025affected < 4.6.2fixed 4.6.2
Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the `FAB_SAFE_
- CVE-2025-24023Mar 3, 2025affected < 4.5.3fixed 4.5.3
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.
- CVE-2024-45314Sep 4, 2024affected < 4.5.1fixed 4.5.1
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch f
- CVE-2024-27083Feb 28, 2024affected >= 4.1.4, < 4.2.1fixed 4.2.1
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject
- CVE-2024-25128Feb 28, 2024affected < 4.3.11fixed 4.3.11
Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could gr
- CVE-2023-34110Jun 22, 2023affected < 4.3.2fixed 4.3.2
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back t
- CVE-2023-29005Apr 10, 2023affected < 4.3.0fixed 4.3.0
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
- CVE-2022-31177Aug 1, 2022affected < 4.1.3fixed 4.1.3
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed passwo
- CVE-2022-24776Mar 24, 2022affected < 3.4.5fixed 3.4.5
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are curre
- CVE-2022-21659Jan 31, 2022affected < 3.4.4fixed 3.4.4
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time
- CVE-2021-41265Dec 9, 2021affected < 3.3.4fixed 3.3.4
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to exis
- CVE-2021-32805Sep 8, 2021affected < 3.3.2fixed 3.3.2
Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user
- CVE-2021-29621Jun 7, 2021affected < 3.3.0fixed 3.3.0
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Up