CVE-2021-41265: Improper Authentication in Flask-AppBuilder
Impact Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints.
Patches Upgrade to Flask-AppBuilder 3.3.4
For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/dpgaspar/Flask-AppBuilder
Other sources
Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41265?
CVE-2021-41265 is a vulnerability in the Flask-AppBuilder development framework prior to version 3.3.4 that allows for improper authentication in the REST API.
How can a malicious actor exploit CVE-2021-41265?
A malicious actor can exploit CVE-2021-41265 by crafting a carefully crafted request to authenticate and gain access to protected REST resources.
What is the severity of CVE-2021-41265?
CVE-2021-41265 has a severity rating of 8.8, which is considered high.
How can I fix CVE-2021-41265?
To fix CVE-2021-41265, update Flask-AppBuilder to version 3.3.4 or later.
Where can I find more information about CVE-2021-41265?
More information about CVE-2021-41265 can be found in the following references: [GitHub Commit](https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc), [GitHub Release](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4), [GitHub Security Advisory](https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q).