GHSA-2ccw-7px8-vmpf

Open Redirect in Flask-AppBuilder

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-24776

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Flask-AppBuilder	< 3.4.5	3.4.5

Details

As written in the advisory (Markdown source, shown as plain text).

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Flask-AppBuilder](https://github.com/dpgaspar/Flask-AppBuilder)

References

External links from the advisory. They lead to third-party sites.

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf web
https://nvd.nist.gov/vuln/detail/CVE-2022-24776 advisory
https://github.com/dpgaspar/Flask-AppBuilder/pull/1804 web
https://github.com/dpgaspar/Flask-AppBuilder/pull/1804/commits/5214d975ebad2ff32057443d2cc20fef1c04d0ea web
https://github.com/dpgaspar/Flask-AppBuilder package
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5 web