CVE-2023-34110: Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
Impact An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. Patches Fixed on 4.3.2
Other sources
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Flask-AppBuilderto a version that resolves this vulnerability.Fixed in 4.3.2 - Upgrade
Upgrade
Flask-AppBuilderto a version that resolves this vulnerability.Fixed in 4.3.2 - Operational
After upgrading to Flask-AppBuilder 4.3.2, rotate any potentially exposed user credentials/passwords, since on certain database engines the error could include the entire user row including the pbkdf2:sha256 hashed password.
Event History
Frequently Asked Questions
What is the impact of vulnerability CVE-2023-34110?
An authenticated malicious actor with Admin privileges could trigger a database error.
How can an attacker exploit vulnerability CVE-2023-34110?
By adding a special character on the add or edit User forms.
What is the severity of vulnerability CVE-2023-34110?
The severity is low with a CVSS score of 2.7.
What is the affected software version of vulnerability CVE-2023-34110?
The affected software version is up to but excluding 4.3.2.
How can I fix vulnerability CVE-2023-34110?
Upgrade to Flask-AppBuilder version 4.3.2 or higher.