CVE-2024-45314: Flask-AppBuilder login form allows browser to cache sensitive fields
Impact Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.
Patches Upgrade flask-appbuilder to version 4.5.1
Workarounds If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"
Other sources
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for /login per the directions provided in the GitHub Security Advisory.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45314?
CVE-2024-45314 is considered a medium severity vulnerability due to its potential risk of exposing sensitive data on shared computing resources.
How do I fix CVE-2024-45314?
To fix CVE-2024-45314, upgrade flask-appbuilder to version 4.5.1 or configure the caching directives appropriately.
What does CVE-2024-45314 affect?
CVE-2024-45314 affects the flask-appbuilder package prior to version 4.5.1.
Who is vulnerable to CVE-2024-45314?
Users of flask-appbuilder versions earlier than 4.5.1 are vulnerable to CVE-2024-45314.
What are the workarounds for CVE-2024-45314?
If upgrading is not possible, configure the caching directives to prevent browsers from storing sensitive data.