CVE-2025-24023: Observable Response Discrepancy in flask-appbuilder
Impact User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.
Patches
Upgrade to flask-appbuilder>=4.5.3
Workarounds Downgrade werkzeug to <3.0.0
References Are there any links users can visit to find out more?
Other sources
Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24023?
CVE-2025-24023 has a medium severity level due to its potential for username enumeration by unauthenticated users.
How do I fix CVE-2025-24023?
To fix CVE-2025-24023, upgrade Flask-AppBuilder to version 4.5.3 or later.
What is the impact of CVE-2025-24023?
CVE-2025-24023 allows attackers to predict valid usernames by measuring response times during login attempts.
Who is affected by CVE-2025-24023?
CVE-2025-24023 affects all Flask-AppBuilder installations prior to version 4.5.3.
Is CVE-2025-24023 a remote or local vulnerability?
CVE-2025-24023 is a remote vulnerability, as it can be exploited by unauthenticated users over the network.