p PatchFirst

CVE-2024-27083

CVE-2024-27083 · Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

CVSS 4.3 · Medium · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • flask-appbuilder

    Versions
    • >= 4.1.4, < 4.2.1: Affected

    No fix published

  • flask-appbuilder PyPI

    Versions
    • 4.1.4
    • 4.1.5
    • 4.1.5rc1
    • 4.1.6
    • 4.1.6rc1
    • 4.1.7rc1
    • 4.2.0
    • 4.2.0rc1
    • 4.2.1rc1
    Affected ranges
    • ECOSYSTEM: ≥ 4.1.4, < 4.2.1

    Update to 4.2.1

Original sources

Check your server →