CVE-2024-27083: Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
Impact A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser.
Impacted versions: Flask-AppBuilder version 4.1.4 up to and including 4.2.0
Patches This issue was introduced on 4.1.4 and patched on 4.2.1, user's should upgrade to 4.2.1 or newer versions.
Other sources
Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27083?
CVE-2024-27083 has been classified as a critical severity vulnerability due to its potential for Cross-Site Scripting attacks.
What types of attacks can be performed using CVE-2024-27083?
An attacker can exploit CVE-2024-27083 through Cross-Site Scripting to execute malicious JavaScript in the context of the user's session.
How do I fix CVE-2024-27083?
To fix CVE-2024-27083, you should upgrade to Flask-AppBuilder version 4.2.1 or later.
Which software is affected by CVE-2024-27083?
CVE-2024-27083 affects Flask-AppBuilder versions 4.1.4 to 4.2.0, specifically during the OAuth login process.
What is the impact of CVE-2024-27083 on users?
Users can be tricked into executing malicious scripts if they visit a specially crafted URL targeting the OAuth login page.