PT-2025-9507 · Pypi · Flask-Appbuilder

Millad7 · Published 2025-03-03 · Updated 2025-03-04 · CVE-2025-24023

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.5.3

Description The issue allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.

Recommendations For versions prior to 4.5.3, update to version 4.5.3 to resolve the issue.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2025-24023

GHSA-P8Q5-CVWX-WVWP

PYSEC-2025-15

Affected Products

Flask-Appbuilder

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24023.json · Exploit
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-15 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p8q5-cvwx-wvwp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24023 · Security Note
• https://osv.dev/vulnerability/CVE-2025-24023 · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2025-15.yaml · Note
• https://twitter.com/CVEnew/status/1896767623443914972 · Twitter Post