CVE-2021-41265: Flask-AppBuilder Improper Authentication Vulnerability
Summary
CVE-2021-41265: Flask-AppBuilder is a development framework built on top of Flask. Affects flask-appbuilder across 2 version ranges.
< 3.3.4
< eba517aab121afa3f3f2edb011ec6bc4efd61fbc
Fixed in eba517aab121afa3f3f2edb011ec6bc4efd61fbc. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Flask-AppBuilder is a development framework built on top of Flask. It provides a set of reusable and customizable components for building web applications. Flask-AppBuilder allows developers to quickly create and manage user interfaces, database models, and REST APIs. It supports various authentication types for securing access to protected resources.
Vulnerability Detail
The REST API in Flask-AppBuilder versions prior to 3.3.4 is affected by an improper authentication vulnerability. This vulnerability allows a malicious actor to authenticate and gain unauthorized access to existing protected REST API endpoints. The issue specifically affects non-database authentication types and new REST API endpoints. An attacker can exploit this vulnerability by sending a carefully crafted request to the API. Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data or functionality.
How To Fix
Minimum fixed version
eba517aab121afa3f3f2edb011ec6bc4efd61fbc
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==eba517aab121afa3f3f2edb011ec6bc4efd61fbc"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Flask-AppBuilder versions prior to 3.3.4 are vulnerable to an improper authentication issue in the REST API. Users should upgrade to the latest version to mitigate the risk of unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-appbuilder →
FAQ
Flask-AppBuilder is a development framework built on top of Flask, providing reusable components for building web applications.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to protected REST API endpoints in Flask-AppBuilder.
Versions prior to 3.3.4 of Flask-AppBuilder are affected by this vulnerability.
No, this vulnerability only affects non-database authentication types.
No, the recommended solution is to upgrade to Flask-AppBuilder 3.3.4 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
