GHSA-fw5r-6m3x-rh7p
Flask-AppBuilder's login form allows browser to cache sensitive fields
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | flask-appbuilder | < 4.5.1 | 4.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.
### Patches
Upgrade flask-appbuilder to version 4.5.1
### Workarounds
If upgrading is not possible configure your web server to send the following HTTP headers for /login:
"Cache-Control": "no-store, no-cache, must-revalidate, max-age=0"
"Pragma": "no-cache"
"Expires": "0"
References
External links from the advisory. They lead to third-party sites.