PT-2024-31566 · Pypi · Flask-Appbuilder

Dpgaspar · Published 2024-09-04 · Updated 2024-09-12 · CVE-2024-45314

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.5.1

Description The auth DB login form default cache directives in Flask-AppBuilder allow browsers to locally store sensitive data. This can be an issue in environments using shared computer resources.

Recommendations For versions prior to 4.5.1, upgrade to version 4.5.1 to resolve the issue. If upgrading is not possible, configure your web server to send the specific HTTP headers for "/login", including "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0", "Pragma": "no-cache", and "Expires": "0".

Exploit

Fix

Weakness Enumeration

CWE-525

Related Identifiers

CVE-2024-45314

GHSA-FW5R-6M3X-RH7P

Affected Products

Flask-Appbuilder

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45314.json · Exploit
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fw5r-6m3x-rh7p · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/commit/3030e881d2e44f4021764e18e489fe940a9b3636 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-45314 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45314 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fw5r-6m3x-rh7p · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://t.me/cvenotify/94385 · Telegram Post
• https://twitter.com/CVEnew/status/1831367376492962073 · Twitter Post
• https://t.me/cvenotify/93313 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1831415699266265141 · Twitter Post
• https://t.me/cvedetector/4804 · Telegram Post