PT-2021-23226 · Unknown · Flask-Appbuilder

Dpgaspar · Published 2021-12-09 · Updated 2021-12-15 · CVE-2021-41265

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 3.3.4

Description The issue is related to improper authentication in the REST API, allowing a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non-database authentication types and new REST API endpoints.

Recommendations For versions prior to 3.3.4, upgrade to Flask-AppBuilder 3.3.4 to receive a patch. As a temporary workaround, consider restricting access to new REST API endpoints until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-41265

GHSA-M3RF-7M4W-R66Q

PYSEC-2021-851

Affected Products

Flask-Appbuilder

References · 10

• https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc · Patch
• https://osv.dev/vulnerability/GHSA-m3rf-7m4w-r66q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41265 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-851 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41265 · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q · Note
• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4 · Note
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2021-851.yaml · Note
• https://t.me/cibsecurity/33721 · Telegram Post