CVE-2023-29005

2023-04-1021:15:07

CWE-307

GitHub_M

web.nvd.nist.gov

flask

appbuilder

cve-2023-29005

rate limiting

credential brute-force

security fix

nvd

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

54.3%

JSON

Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and setting an AUTH_RATE_LIMIT.

Affected configurations

Nvd

Vulners

Node

flask-appbuilder_projectflask-appbuilderRange<4.3.0

VendorProductVersionCPE
flask-appbuilder_projectflask-appbuilder*cpe:2.3:a:flask-appbuilder_project:flask-appbuilder:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
flask-appbuilder_project	flask-appbuilder	*	cpe:2.3:a:flask-appbuilder_project:flask-appbuilder::::::::

CNA Affected

[
  {
    "vendor": "dpgaspar",
    "product": "Flask-AppBuilder",
    "versions": [
      {
        "version": "< 4.3.0",
        "status": "affected"
      }
    ]
  }
]