Login Request a demo
Medium severity · published Feb 29, 2024
CVE-2024-27083
Flask-AppBuilder is an application development framework, built on top of Flask
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flask-appbuilder · Dpgaspar
4.1.4 before 4.2.1 · source: NVD
Affected product
FL
Flask-appbuilder
Dpgaspar
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-27083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-27083
Patch
https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812
Vendor Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84
More from Flask-appbuilder
9.1
CVE-2024-25128
Flask-AppBuilder is an application development framework, built on top of Flask
8.8
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask
7.5
CVE-2023-29005
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials
6.5
CVE-2025-58065
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
6.1
CVE-2025-32962
Flask-AppBuilder open redirect vulnerability using HTTP host injection