CVE-2025-24023: Observable Response Discrepancy in flask-appbuilder

Published Mar 3, 2025
·
Updated

Impact User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.

Patches

Upgrade to flask-appbuilder>=4.5.3

Workarounds Downgrade werkzeug to <3.0.0

References Are there any links users can visit to find out more?

Other sources

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

MITRE

Affected Software

3 affected componentsFixes available
Apache Flask-AppBuilder<4.5.3
dpgaspar Flask-AppBuilder<4.5.3
pip/flask-appbuilder<4.5.3
4.5.3

Event History

Mar 3, 2025
CVE Published
via MITRE·03:25 PM
Data Sourced
via MITRE·03:25 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:26 PM
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
Affected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-24023?

CVE-2025-24023 has a medium severity level due to its potential for username enumeration by unauthenticated users.

2

How do I fix CVE-2025-24023?

To fix CVE-2025-24023, upgrade Flask-AppBuilder to version 4.5.3 or later.

3

What is the impact of CVE-2025-24023?

CVE-2025-24023 allows attackers to predict valid usernames by measuring response times during login attempts.

4

Who is affected by CVE-2025-24023?

CVE-2025-24023 affects all Flask-AppBuilder installations prior to version 4.5.3.

5

Is CVE-2025-24023 a remote or local vulnerability?

CVE-2025-24023 is a remote vulnerability, as it can be exploited by unauthenticated users over the network.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203