PT-2022-16871 · Pypi · Flask-Appbuilder

Dpgaspar · Published 2022-03-24 · Updated 2022-04-05 · CVE-2022-24776

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 3.4.5

Description Flask-AppBuilder contains an open redirect vulnerability when using the database authentication login page. This issue is fixed in version 3.4.5. There are currently no known workarounds.

Recommendations For versions prior to 3.4.5, upgrade to version 3.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the database authentication login page until the upgrade is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-24776

GHSA-2CCW-7PX8-VMPF

Affected Products

Flask-Appbuilder

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24776.json · Exploit
• https://github.com/dpgaspar/Flask-AppBuilder/pull/1804 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24776 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24776 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2ccw-7px8-vmpf · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://github.com/dpgaspar/Flask-AppBuilder/pull/1804/commits/5214d975ebad2ff32057443d2cc20fef1c04d0ea · Note
• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5 · Note
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf · Note
• https://t.me/cibsecurity/39515 · Telegram Post