Description
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dpgaspar | Flask-AppBuilder | < 4.5.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | flask-appbuilder | < 4.5.3 | 4.5.3 | GHSA-p8q5-cvwx-wvwp |