CVE-2025-24023CWE-204

Observable Response Discrepancy in flask-appbuilder

Low · published March 3, 2025

CVSS v3.1
3.7
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.1th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-03-03T15:25Z
EPSS history
Timeline
  • 03 MAR 15:25Z
    Observable Response Discrepancy in flask-appbuilder
    cvelistv5