CVE-2023-34110lowCWE-209

CVE-2023-34110: fallo de gravedad baja en dpgaspar Flask-AppBuilder

Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Flask-AppBuilder+ Monitorear flask-appbuilder

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.7epss 0.7%
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Productos afectados
dpgaspar · Flask-AppBuilder
CVEs relacionadas — dpgaspar Flask-AppBuilder

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-29621MEDIUMObservable Response Discrepancy in Flask-AppBuilderEPSS 3.4%CVE-2021-41265HIGHImproper Authentication in Flask-AppBuilderEPSS 1.3%CVE-2022-24776MEDIUMOpen Redirect in Flask-AppBuilderEPSS 1.0%CVE-2024-25128CRITICALFlask-AppBuilder incorrect authentication when using auth type OpenID EPSS 0.9%CVE-2022-31177LOWPossible to infer sensitive information through query strings in Flask-AppBuilderEPSS 0.8%CVE-2021-32805HIGHURL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilderEPSS 0.7%