CVE-2021-32805
Description
Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability. To resolve this issue upgrade to Flask-AppBuilder 3.2.2 or above. If upgrading is infeasible users may filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting as a workaround.
How to fix
- dpgaspar flask-appbuilder3.3.2 or later
- flask-appbuilder3.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dpgaspar flask-appbuilder | v < 3.3.2 | 3.3.2 |
| flask-appbuilderPyPI | v < 3.3.2 | 3.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.