GitHub Advisoryadvisory · PyPI

GHSA-p8q5-cvwx-wvwp Flask-AppBuilder Observable Response Discrepancy

LOW Published 2025-03-03 Modified 2025-04-09 Official page ↗
Aliases
CVE-2025-24023
Ecosystem
PyPI
Packages
flask-appbuilder
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-204
Reviewed
2025-03-03

Affected packages

• PyPI flask-appbuilder: < 4.5.3 → fixed in 4.5.3

Description

Impact User enumeration in database authentication in Flask-AppBuilder = 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. Patches Upgrade to flask-appbuilder>=4.5.3 Workarounds Downgrade werkzeug to <3.0.0 References _Are there any links users can visit to find out more?_

Related

Alias · CVE (1)

  • CVE-2025-24023 Flask-AppBuilder is an application development framework. vulnerability

Weakness · CWE (1)

  • CWE-204 Observable Response Discrepancy weakness

References