Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-41265

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.

Published

2021-12-09T17:15:07.963

Last Modified

2025-03-07T14:37:51.330

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	dpgaspar	flask-appbuilder	< 3.3.4	Yes

References

https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc Patch, Third Party Advisory ([email protected])
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4 Release Notes, Third Party Advisory ([email protected])
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q Third Party Advisory ([email protected])
https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)