CVE-2023-34110CWE-209

Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

Low · published June 22, 2023

CVSS v3.1
2.7
EPSS
1%
Percentile
51.7
In the wild
Unconfirmed
What it is

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00676 · 51.7th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2023-06-22T22:34Z
EPSS history
Timeline
  • 22 JUN 22:34Z
    Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
    cvelistv5