Lookup for vulnerable packages by Package URL.
| Purl | pkg:pypi/flask-appbuilder@4.0.0rc2 |
|---|
| Type | pypi |
|---|
| Namespace | |
|---|
| Name | flask-appbuilder |
|---|
| Version | 4.0.0rc2 |
|---|
| Qualifiers |
|
|---|
| Subpath | |
|---|
| Is_vulnerable | true |
|---|
| Next_non_vulnerable_version | 4.5.3 |
|---|
| Latest_non_vulnerable_version | 4.5.3 |
|---|
| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-cefr-t1w9-9yck |
| vulnerability_id |
VCID-cefr-t1w9-9yck |
| summary |
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://github.com/dpgaspar/Flask-AppBuilder/pull/2045 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
2.7 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
5.1 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-12-06T15:28:12Z/ |
|
|
| url |
https://github.com/dpgaspar/Flask-AppBuilder/pull/2045 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2023-34110, GHSA-jhpr-j7cq-3jp3, PYSEC-2023-94
|
| risk_score |
null |
| exploitability |
0.5 |
| weighted_severity |
0.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cefr-t1w9-9yck |
|
| 1 |
| url |
VCID-cezb-crna-wbgc |
| vulnerability_id |
VCID-cezb-crna-wbgc |
| summary |
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-24023, GHSA-p8q5-cvwx-wvwp, PYSEC-2025-15
|
| risk_score |
2.4 |
| exploitability |
0.5 |
| weighted_severity |
4.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cezb-crna-wbgc |
|
| 2 |
| url |
VCID-dqzq-crpp-73f7 |
| vulnerability_id |
VCID-dqzq-crpp-73f7 |
| summary |
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2022-31177, GHSA-32ff-4g79-vgfc, PYSEC-2022-247
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dqzq-crpp-73f7 |
|
|
|---|
| Fixing_vulnerabilities |
|
|---|
| Risk_score | 2.4 |
|---|
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:pypi/flask-appbuilder@4.0.0rc2 |
|---|