Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

THẤP 2.7CVE-2023-34110 · GHSA-jhpr-j7cq-3jp3 · PYSEC-2023-94 · Công bố 22/06/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-34110 là lỗ hổng mức THẤP (CVSS 2.7) ảnh hưởng flask-appbuilder, flask-appbuilder (flask-appbuilder project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.68%, cao hơn 52.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.3.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
flask-appbuilder PyPI	`< 4.3.2`	`4.3.2`
flask-appbuilder flask-appbuilder_project	`< 4.3.2`	`4.3.2`

Mô tả

Impact

An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password.

Patches

Fixed on 4.3.2

Mô tả của NVD

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.