flask-appbuilder@0.10.3 vulnerabilities

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Information Exposure Through Browser Caching due to the default cache directives of the auth DB login form, allowing sensitive data to be stored locally by the browser. An attacker can access the sensitive data stored locally by exploiting shared computer environments.

Upgrade Flask-AppBuilder to version 4.5.1 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Improper Authentication due to incorrect authentication handling when using the AUTH_OID auth type. An attacker can forge an HTTP request to deceive the backend into using any requested OpenID service, potentially granting unauthorized privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend.

Note:

This is only exploitable when the application uses the old OpenID 2.0 authorization protocol, which is considered legacy and has been deprecated for over a decade.

Upgrade Flask-AppBuilder to version 4.3.11 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Information Exposure such that an authenticated malicious actor with Admin privileges, can edit User forms and trigger a database error. On certain database engines, this error can include the entire user row including the pbkdf2:sha256 hashed password.

Upgrade Flask-AppBuilder to version 4.3.2 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Brute Force due to the lack of rate limiting which will allow an attacker to obtain user credentials.

Upgrade Flask-AppBuilder to version 4.3.0 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Information Exposure by revealing partial password hashes using crafted HTTP requests that filter users by the contents of their salted hashed password strings.

NOTE: This vulnerability is exploitable only when the AUTH_DB option is in use.

Upgrade Flask-AppBuilder to version 4.1.3 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Open Redirect via the usage of the database authentication login page.

Upgrade Flask-AppBuilder to version 3.4.5 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Timing Attack which allows for a non-authenticated user to enumerate existing accounts by timing the response time from the server when logging in.

Upgrade Flask-AppBuilder to version 3.4.4 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Access Restriction Bypass due to improper authentication on the REST API. This allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints.

Only affects non-database authentication types, and new REST API endpoints.

Upgrade Flask-AppBuilder to version 3.3.4 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Insecure Permissions due to missing mapping validation of permissions.

Upgrade Flask-AppBuilder to version 2.1.4 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Open Redirect. If using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder and redirect a user to a malicious site.

Upgrade Flask-AppBuilder to version 3.3.2 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Access Restriction Bypass. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

Upgrade Flask-AppBuilder to version 3.3.0 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Incorrect Default Permissions. No permissions were required by default in pvm, perm and vm mvc views config options. The fix gives the user the ability to toggle permissions on and off.

Upgrade Flask-AppBuilder to version 2.2.3 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to Information Exposure. Attackers were able to masquerade as an authenticated user through OAuth providers. The fix changes the ID that is used to link a google login to an account to an immutable user ID that is provided by google. The previous implementation used the display name, which could easily be changed at any point and used to log in to a different account by an attacker.

Upgrade Flask-AppBuilder to version 1.9.0 or higher.

Flask-AppBuilder is a simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.

Affected versions of this package are vulnerable to SQL Injection in order by clauses.

Upgrade Flask-AppBuilder to version 1.9.3 or higher.