CVE-2023-29005
published 2023-04-10CVE-2023-29005: Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.63%
45.9th percentile
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dpgaspar | flask-appbuilder | < 4.3.0 | 4.3.0 |
| dpgaspar | flask-appbuilder | >= 0 < 4.3.0 | 4.3.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
osv·2023-04-10
CVE-2023-29005 [HIGH] Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
### Impact
Lack of rate limiting will allow an attacker to brute-force user credentials.
### Patches
Ability to enable rate limiting on Flask-AppBuilder >= 4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication.
### Workarounds
Implement rate limiting using a reverse proxy or other strategies.
GHSA
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
ghsa·2023-04-10
CVE-2023-29005 [HIGH] CWE-307 Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
### Impact
Lack of rate limiting will allow an attacker to brute-force user credentials.
### Patches
Ability to enable rate limiting on Flask-AppBuilder >= 4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication.
### Workarounds
Implement rate limiting using a reverse proxy or other strategies.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-04-10
Published