Vulnerability Description
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dpgaspar | Flask-Appbuilder | < 3.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ecPatchThird Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4Release NotesThird Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-Third Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ecPatchThird Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4Release NotesThird Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-Third Party Advisory
FAQ
What is CVE-2021-41265?
CVE-2021-41265 is a vulnerability with a CVSS score of 8.1 (HIGH). Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with ...
How severe is CVE-2021-41265?
CVE-2021-41265 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-41265?
Check the references section above for vendor advisories and patch information. Affected products include: Dpgaspar Flask-Appbuilder.