| Package | Affected versions | Patched versions |
|---|---|---|
| flask-appbuilder | < 4.5.3 | 4.5.3 |
| flask-appbuilder | < 4.5.3 | 4.5.3 |
User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.
Upgrade to flask-appbuilder>=4.5.3
Downgrade werkzeug to <3.0.0
Are there any links users can visit to find out more?
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free