Read the docs
TI-2024-30385 Aliases CVE-2024-45314GHSA-fw5r-6m3x-rh7p

Flask-AppBuilder login form allows browser to cache sensitive fields

Priority LOW 24CWE-525Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Fix Fixed Flask-AppBuilder (dpgaspar): 4.5.1flask-appbuilder (PyPI): 4.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dpgasparFlask-AppBuilderbefore 4.5.14.5.1Patch availableCNA
—flask-appbuilder (PyPI)before 4.5.14.5.1Patch availableGHSA-fw5r-6m3x-rh7p
  • Flask-AppBuilder Vendordpgaspar Affected before 4.5.1 Fixed in 4.5.1 Patch available CNA
  • flask-appbuilder (PyPI) Vendor— Affected before 4.5.1 Fixed in 4.5.1 Patch available GHSA-fw5r-6m3x-rh7p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dpgaspar:flask-appbuilder:*:*:*:*:*:*:*:*before 4.5.1Vulnerabledpgaspar
  • cpe:2.3:a:dpgaspar:flask-appbuilder:*:*:*:*:*:*:*:* Versions before 4.5.1 Vulnerable ·dpgaspar

Remediation

  • Fix · CNA Flask-AppBuilder (dpgaspar) Fixed in 4.5.1
  • Fix · GHSA-fw5r-6m3x-rh7p flask-appbuilder (PyPI) Fixed in 4.5.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45314
  2. 2026-10-03 Alias added: GHSA-fw5r-6m3x-rh7p

References

Patch 1

Advisory 2

Other 1

  • TI-2024-17946 Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.1
  • TI-2024-16581 Flask-AppBuilder incorrect authentication when using auth type OpenID CVSS 3.1CRITICAL 9.1
  • TI-2021-18097 Improper Authentication in Flask-AppBuilder CVSS 3.1HIGH 8.8
  • TI-2023-13466 No Rate Limiting on Login AUTH DB CVSS 3.1HIGH 7.5
  • TI-2021-12470 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder CVSS 3.1HIGH 7.2
  • TI-2022-06037 Observable Response Discrepancy in Flask-AppBuilder CVSS 3.1MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences