An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1qaHByLWo3Y3EtM2pwM84AAz_s
Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password.
Fixed on 4.3.2Permalink: https://github.com/advisories/GHSA-jhpr-j7cq-3jp3
Source: GitHub Advisory Database
Published: 5 months ago
Updated: 22 days ago
CVSS Score: 2.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Identifiers: GHSA-jhpr-j7cq-3jp3, CVE-2023-34110
Fixed in: 4.3.2