Medium severity · published Mar 3, 2025
CVE-2025-24023
Observable Response Discrepancy in flask-appbuilder
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flask-AppBuilder · dpgaspar
< 4.5.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-24023
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-24023
Vendor Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp
More from Flask-AppBuilder
9.1
CVE-2024-25128
Flask-AppBuilder is an application development framework, built on top of Flask
8.8
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask
7.5
CVE-2023-29005
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials
6.5
CVE-2025-58065
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
6.1
CVE-2025-32962
Flask-AppBuilder open redirect vulnerability using HTTP host injection