CVE-2021-41265
High
Description
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.
SeverityHigh
CVSS8.1
Exploit probability—
ProductDpgaspar Flask-appbuilder
PublishedDec 9, 2021
First seenDec 9, 2021
Weakness typeCWE-287Improper authentication
How to fix
Update
- dpgaspar flask-appbuilder3.3.4 or later
- flask-appbuilder3.3.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dpgaspar flask-appbuilder | v < 3.3.4 | 3.3.4 |
| flask-appbuilderPyPI | v < 3.3.4 | 3.3.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.