Vulnerability · Published Feb 28, 2024 · Assigned by GitHub_M
CVE-2024-27083Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
Medium 4.3
In plain English
A medium-severity cross-site scripting in Flask-AppBuilder from dpgaspar. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | flask-appbuilder | 4.2.1 | GHSA-fqxj-46wg-9v84 |
| PyPI | flask-appbuilder | 4.2.1 | PYSEC-2026-1381 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| dpgaspar | Flask-AppBuilder | >= 4.1.4, < 4.2.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N