CVE-2024-45314 — Use of Web Browser Cache Containing Sensitive Information in Flask-appbuilder

CWE-525 — Use of Web Browser Cache Containing Sensitive Information4 documents4 sources

Severity

5.5MEDIUMNVD

CNA3.6

EPSS

0.1%

top 66.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Dpgaspar Flask-appbuilder

Timeline

PublishedSep 4

Description

Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5dpgaspar/flask-appbuilder< 4.5.1

▶NVDdpgaspar/flask-appbuilder< 4.5.1

▶PyPIdpgaspar/flask-appbuilder< 4.5.1

Patches

Patch: github.com ↗

🔴Vulnerability Details

OSV

Flask-AppBuilder's login form allows browser to cache sensitive fields↗2024-09-04

▶

GHSA

Flask-AppBuilder's login form allows browser to cache sensitive fields↗2024-09-04

▶

CVEList

Flask-AppBuilder login form allows browser to cache sensitive fields↗2024-09-04

▶