CVE-2021-32805: falha de alta gravidade em dpgaspar Flask-AppBuilder
URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.7%
Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability. To resolve this issue upgrade to Flask-AppBuilder 3.2.2 or above. If upgrading is infeasible users may filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting as a workaround.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
dpgaspar · Flask-AppBuilderCVEs relacionadas — dpgaspar Flask-AppBuilder
No mesmo produto, das mais perigosas para as menos.
CVE-2021-29621MEDIUMObservable Response Discrepancy in Flask-AppBuilderEPSS 3.4%CVE-2021-41265HIGHImproper Authentication in Flask-AppBuilderEPSS 1.3%CVE-2022-24776MEDIUMOpen Redirect in Flask-AppBuilderEPSS 1.0%CVE-2024-25128CRITICALFlask-AppBuilder incorrect authentication when using auth type OpenID EPSS 0.9%CVE-2022-31177LOWPossible to infer sensitive information through query strings in Flask-AppBuilderEPSS 0.8%CVE-2023-34110LOWFlask-AppBuilder vulnerable to possible disclosure of sensitive information on user errorEPSS 0.7%