dpgaspar/flask-appbuilder · Security
Flask-AppBuilder Observable Response Discrepancy
- GHSA ID
- GHSA-p8q5-cvwx-wvwp
- CVE ID
- CVE-2025-24023
- Severity
- low
- Published
- Updated
- CVSS
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 3.7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Impact
User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.
Patches
Upgrade to flask-appbuilder>=4.5.3
Workarounds
Downgrade werkzeug to <3.0.0
References
Are there any links users can visit to find out more?
CWEs
- CWE-204 · Observable Response Discrepancy