CVE-2023-34110

published 2023-06-22

CVE-2023-34110: Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin…

Priority P4 10 low 2.7 CVSS 3.1

AV N AC L PR H UI N S U C L I N A N

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
dpgaspar	flask-appbuilder	< 4.3.2	4.3.2
dpgaspar	flask-appbuilder	>= 0 < 4.3.2	4.3.2
dpgaspar	flask-appbuilder	>= 0 < ae25ad4c87a9051ebe4a4e8f02aee73232642626	ae25ad4c87a9051ebe4a4e8f02aee73232642626
flask-appbuilder_project	flask-appbuilder	< 4.3.2	4.3.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-209