Vulnerabilities for flask-appbuilder

First version without a known vulnerability: 5.0.0rc1

Details

• GHSA-765j-9r45-w2q22025-09-11

  Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

  Fixed in: 4.8.1

• GHSA-99pm-ch96-ccp22025-05-16

  Flask-AppBuilder open redirect vulnerability using HTTP host injection

  Fixed in: 4.6.2

• GHSA-p8q5-cvwx-wvwp2025-03-03

  Flask-AppBuilder Observable Response Discrepancy

  Fixed in: 4.5.3

• GHSA-fw5r-6m3x-rh7p2024-09-04

  Flask-AppBuilder's login form allows browser to cache sensitive fields

  Fixed in: 4.5.1

• GHSA-j2pw-vp55-fqqj2024-02-28

  Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID

  Fixed in: 4.3.11

• GHSA-fqxj-46wg-9v842024-02-28

  Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

  Fixed in: 4.2.1

• GHSA-jhpr-j7cq-3jp32023-06-22

  Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error

  Fixed in: 4.3.2, ae25ad4c87a9051ebe4a4e8f02aee73232642626

• GHSA-9hcr-9hcv-x6pv2023-04-10

  Flask-AppBuilder Has No Rate Limiting on Login AUTH DB

  Fixed in: 4.3.0

• GHSA-32ff-4g79-vgfc2022-07-29

  Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

  Fixed in: 4.1.3

• GHSA-2ccw-7px8-vmpf2022-03-25

  Open Redirect in Flask-AppBuilder

  Fixed in: 3.4.5

• GHSA-wfjw-w6pv-8p7f2022-02-01

  Observable Response Discrepancy in Flask-AppBuilder

  Fixed in: 3.4.4, 3.4.2

• GHSA-m3rf-7m4w-r66q2021-12-09

  Improper Authentication in Flask-AppBuilder

  Fixed in: 3.3.4, eba517aab121afa3f3f2edb011ec6bc4efd61fbc

• GHSA-624f-cqvr-3qw42021-09-08

  Flask-AppBuilder Open Redirect vulnerability

  Fixed in: 3.3.2, 6af28521589599b1dbafd6313256229ee9a4fa74

• GHSA-434h-p4gx-jm892021-05-27

  Observable Response Discrepancy in Flask-AppBuilder

  Fixed in: 3.3.0, 780bd0e8fbf2d36ada52edb769477e0a4edae580