GitHub Advisoryadvisory · PyPI

GHSA-624f-cqvr-3qw4 Flask-AppBuilder Open Redirect vulnerability

MEDIUM Published 2021-09-08 Modified 2025-03-07 Official page ↗
Aliases
CVE-2021-32805
Ecosystem
PyPI
Packages
Flask-AppBuilder
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-09-08

Affected packages

• PyPI Flask-AppBuilder: < 3.3.2 → fixed in 3.3.2

Description

Impact If using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability Patches Install Flask-AppBuilder 3.2.2 or above Workarounds Filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting

Related

Alias · CVE (1)

  • CVE-2021-32805 Flask-AppBuilder is an application development framework, built on top of Flask. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References