CVE-2023-34110 — Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding …
Published: 2023-06-22 · CVSS: 2.7 · CVSS 3.1
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7