CVE-2021-41265: fallo de gravedad alta en dpgaspar Flask-AppBuilder
Improper Authentication in Flask-AppBuilder
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 1.3%
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
dpgaspar · Flask-AppBuilderCVEs relacionadas — dpgaspar Flask-AppBuilder
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-29621MEDIUMObservable Response Discrepancy in Flask-AppBuilderEPSS 3.4%CVE-2022-24776MEDIUMOpen Redirect in Flask-AppBuilderEPSS 1.0%CVE-2024-25128CRITICALFlask-AppBuilder incorrect authentication when using auth type OpenID EPSS 0.9%CVE-2022-31177LOWPossible to infer sensitive information through query strings in Flask-AppBuilderEPSS 0.8%CVE-2021-32805HIGHURL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilderEPSS 0.7%CVE-2023-34110LOWFlask-AppBuilder vulnerable to possible disclosure of sensitive information on user errorEPSS 0.7%