CVE-2018-16516: Cross-Site Scripting in Flask-Admin
Summary
CVE-2018-16516: Flask-Admin Cross-site Scripting vulnerability. Affects flask-admin versions < 1.5.3. Fixed in 1.5.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flask-Admin is a Python package that provides an administrative interface for Flask applications. It offers a set of pre-built views and helpers to manage application data. This vulnerability affects Flask-Admin version 1.5.2. Flask-Admin allows users to perform administrative tasks on a Flask application, such as managing database records and user accounts. However, a cross-site scripting (XSS) vulnerability exists in the 'helpers.py' file of Flask-Admin version 1.5.2. This vulnerability can be exploited through a crafted URL, leading to the execution of arbitrary JavaScript code in the context of the victim's browser.
Vulnerability Detail
The vulnerability in Flask-Admin version 1.5.2 is a reflected XSS vulnerability. It occurs when user-supplied input is not properly sanitized and is included in a web page without proper escaping. An attacker can exploit this vulnerability by crafting a malicious URL that includes JavaScript code. When a victim clicks on the malicious URL, the JavaScript code is executed in the victim's browser, potentially allowing the attacker to steal sensitive information, perform actions on behalf of the victim, or manipulate the displayed content. This vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.5.3
This is the first release that contains the fix.
pip install --upgrade "flask-admin==1.5.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Flask-Admin as soon as possible.
Conclusion
Flask-Admin version 1.5.2 is vulnerable to a reflected XSS vulnerability, which can be exploited through a crafted URL. Upgrading to Flask-Admin version 1.5.3 or later is recommended to fix this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-admin →
FAQ
Flask-Admin is a Python package that provides an administrative interface for Flask applications. It allows users to perform administrative tasks such as managing database records and user accounts.
A reflected XSS vulnerability occurs when user-supplied input is not properly sanitized and is included in a web page without proper escaping. This allows an attacker to inject and execute arbitrary JavaScript code in the victim's browser.
This vulnerability can be exploited by crafting a malicious URL that includes JavaScript code. When a victim clicks on the malicious URL, the JavaScript code is executed in the victim's browser, potentially allowing the attacker to steal sensitive information or perform actions on behalf of the victim.
This vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
Yes, upgrading Flask-Admin to version 1.5.3 or later fixes this vulnerability. The fix ensures that user-supplied input is properly sanitized to prevent XSS attacks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
