CVE-2021-32805 — Open Redirect in Flask-appbuilder

CWE-601 — Open Redirect5 documents4 sources
Severity
6.1MEDIUMNVD
CNA7.2
EPSS
0.2%
top 59.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Dpgaspar Flask-appbuilder
Timeline
PublishedSep 8

Description

Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability. To resolve this issue upgrade to Flask-AppBuilder 3.2.2 or above. If upgrading is infeasible users may filter HTTP traffic containing `?next={next-site}` where…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5dpgaspar/flask-appbuilder< 3.3.2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Flask-AppBuilder Open Redirect vulnerability↗2021-09-08
▶
CVEList
URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder↗2021-09-08
▶
OSV
Flask-AppBuilder Open Redirect vulnerability↗2021-09-08
▶
OSV
CVE-2021-32805: Flask-AppBuilder is an application development framework, built on top of Flask↗2021-09-08
▶
CVE-2021-32805 — Open Redirect in Flask-appbuilder | cvebase