PT-2023-24682 · Pypi · Flask-Appbuilder

Msegoviag · Publicado 2023-06-22 · Atualizado 2026-06-03 · CVE-2023-34110

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.3.2

Description An authenticated malicious actor with Admin privileges could trigger a database error by adding a special character on the add or edit User forms. This error can be surfaced back to the actor on the UI and, on certain database engines, may include the entire user row, including the pbkdf2:sha256 hashed password.

Recommendations For versions prior to 4.3.2, update to version 4.3.2 to resolve the issue. As a temporary workaround, consider restricting access to the add and edit User forms for users with Admin privileges until the update is applied.

Exploit

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

CVE-2023-34110

GHSA-JHPR-J7CQ-3JP3

PYSEC-2023-94

Produtos afetados

Flask-Appbuilder

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34110.json · Exploit
• https://github.com/dpgaspar/Flask-AppBuilder · Nota
• https://github.com/dpgaspar/Flask-AppBuilder/pull/2045 · Correção
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-jhpr-j7cq-3jp3 · Aviso do Fabricante
• https://github.com/dpgaspar/Flask-AppBuilder/commit/ae25ad4c87a9051ebe4a4e8f02aee73232642626 · Correção
• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.3.2 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2023-94.yaml · Nota
• https://osv.dev/vulnerability/CVE-2023-34110 · Aviso do Fabricante
• https://t.me/cvenotify/52910 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-34110 · Nota de Segurança
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-34110 · Aviso do Fabricante
• https://t.me/cibsecurity/65439 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-94 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jhpr-j7cq-3jp3 · Aviso do Fabricante