Medium severity · published Mar 24, 2022
CVE-2022-24776
Flask-AppBuilder is an application development framework, built on top of the Flask web framework
6.1
CVSS
1%
EPSS
No
On KEV
Description
Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flask-appbuilder · Dpgaspar
before 3.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24776
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24776
Patch
https://github.com/dpgaspar/Flask-AppBuilder/pull/1804
Release Notes
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5
Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf
More from Flask-appbuilder
9.1
CVE-2024-25128
Flask-AppBuilder is an application development framework, built on top of Flask
8.8
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask
7.5
CVE-2023-29005
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials
6.5
CVE-2025-58065
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
6.1
CVE-2025-32962
Flask-AppBuilder open redirect vulnerability using HTTP host injection