GitHub Advisoryadvisory · PyPI

GHSA-fw5r-6m3x-rh7p Flask-AppBuilder's login form allows browser to cache sensitive fields

MEDIUM Published 2024-09-04 Modified 2024-11-18 Official page ↗
Aliases
CVE-2024-45314
Ecosystem
PyPI
Packages
flask-appbuilder
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Weaknesses
CWE-525
Reviewed
2024-09-04

Affected packages

• PyPI flask-appbuilder: < 4.5.1 → fixed in 4.5.1

Description

Impact Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Patches Upgrade flask-appbuilder to version 4.5.1 Workarounds If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"

Related

Alias · CVE (1)

  • CVE-2024-45314 Flask-AppBuilder is an application development framework. vulnerability

Weakness · CWE (1)

  • CWE-525 Use of Web Browser Cache Containing Sensitive Information weakness

References