CVE-2024-45314 — LOW (3.6) — White Hats Nepal

Q: How severe is CVE-2024-45314?

CVE-2024-45314 has been rated LOW with a CVSS base score of 3.6/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2024-45314?

Check the references section above for vendor advisories and patch information. Affected products include: Dpgaspar Flask-Appbuilder.

Vulnerability Description

Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory.

CVSS Score

3.6

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Dpgaspar	Flask-Appbuilder	< 4.5.1

Related Weaknesses (CWE)

CWE-525

References

FAQ

What is CVE-2024-45314?

CVE-2024-45314 is a vulnerability with a CVSS score of 3.6 (LOW). Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue o...

How severe is CVE-2024-45314?

CVE-2024-45314 has been rated LOW with a CVSS base score of 3.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-45314?

Check the references section above for vendor advisories and patch information. Affected products include: Dpgaspar Flask-Appbuilder.