CVE-2025-24023 — Observable Response Discrepancy in flask-appbuilder
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response ti…
Published: 2025-03-03 · CVSS: 3.7 · CVSS 3.1
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7