GHSA-p8q5-cvwx-wvwp
Flask-AppBuilder Observable Response Discrepancy
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | flask-appbuilder | < 4.5.3 | 4.5.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.
### Patches
Upgrade to flask-appbuilder>=4.5.3
### Workarounds
Downgrade werkzeug to <3.0.0
### References
_Are there any links users can visit to find out more?_
References
External links from the advisory. They lead to third-party sites.