Flask Appbuilder
Approved changes feed: RSS · Atom
cpe:2.3:a:flask-appbuilder_project:flask-appbuilder:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Flask Appbuilder Project (7385eabb-ce07-5783-a177-98c383e8bd93) |
|---|---|
| Product | Flask Appbuilder (7939ac63-72fb-5b18-b989-9276073b6c49) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/dpgaspar/flask-appbuilder |
purl2cpe | 2026-06-01 10:12:57.683537 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-34110 |
vulnerable | 2026-06-08 06:06:24.524097 |
Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
LOW (2.7)
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
Published: 2023-06-22T22:34:39.865Z
Updated: 2024-12-06T15:28:20.356Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29005 |
vulnerable | 2026-06-08 06:02:37.909676 |
No Rate Limiting on Login AUTH DB
HIGH (7.5)
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
Published: 2023-04-10T20:47:17.958Z
Updated: 2025-02-07T19:35:38.143Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31177 |
vulnerable | 2026-06-08 05:43:40.337445 |
Possible to infer sensitive information through query strings in Flask-AppBuilder
LOW (2.7)
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
Published: 2022-08-01T19:05:11.000Z
Updated: 2025-04-23T17:56:34.614Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24776 |
vulnerable | 2026-06-08 05:41:01.606820 |
Open Redirect in Flask-AppBuilder
MEDIUM (6.1)
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.
Published: 2022-03-24T19:45:14.000Z
Updated: 2025-04-23T18:44:03.621Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-21659 |
vulnerable | 2026-06-08 05:40:01.943816 |
Observable Response Discrepancy in Flask-AppBuilder
MEDIUM (5.3)
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.
Published: 2022-01-31T20:20:40.000Z
Updated: 2025-05-05T16:34:10.131Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41265 |
vulnerable | 2026-06-08 05:35:20.068855 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32805 |
vulnerable | 2026-06-08 05:32:08.061574 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-29621 |
vulnerable | 2026-06-08 05:31:26.591937 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.