GHSA-m3rf-7m4w-r66q

Improper Authentication in Flask-AppBuilder

Source: GitHub Advisory Database (reviewed) High CVE-2021-41265

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Flask-AppBuilder	< 3.3.4	3.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints. ### Patches Upgrade to Flask-AppBuilder 3.3.4 ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/dpgaspar/Flask-AppBuilder

References

External links from the advisory. They lead to third-party sites.

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q web
https://nvd.nist.gov/vuln/detail/CVE-2021-41265 advisory
https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc web
https://github.com/dpgaspar/Flask-AppBuilder package
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4 web
https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2021-851.yaml web