~ / search / GHSA-624f-cqvr-3qw4

GHSA-624f-cqvr-3qw4

Flask-AppBuilder Open Redirect vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-32805

Packages

EcosystemPackageAffectedFixed in
PyPI Flask-AppBuilder < 3.3.2 3.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact If using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability ### Patches Install Flask-AppBuilder 3.2.2 or above ### Workarounds Filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting

References

External links from the advisory. They lead to third-party sites.