CVE-2023-29005 No Rate Limiting on Login AUTH DB

2023-04-1020:47:17

CWE-307

GitHub_M

www.cve.org

cve-2023-29005

flask-appbuilder

rate limiting

brute-force

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.002

Percentile

52.3%

JSON

Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and setting an AUTH_RATE_LIMIT.

CNA Affected

[
  {
    "vendor": "dpgaspar",
    "product": "Flask-AppBuilder",
    "versions": [
      {
        "version": "< 4.3.0",
        "status": "affected"
      }
    ]
  }
]