CVE-2024-45314Low· 3.6▾ SunlitFlask-AppBuilder's login form allows browser to cache sensitive fields
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.3%
Last analysed / modified upstream
Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.
Upgrade flask-appbuilder to version 4.5.1
If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"
flask-appbuilder < 4.5.1Upgrade to a patched release:
flask-appbuilder 4.5.1Connected by shared product, vendor, weakness, or advisory.
CVE-2022-21659Medium· 5.3Observable Response Discrepancy in Flask-AppBuilder
CVE-2025-24023Low· 3.7Flask-AppBuilder Observable Response Discrepancy
CVE-2024-25128Critical· 9.1Flask-AppBuilder vulnerable to incorrect authentication when using auth type OpenID
CVE-2021-41265High· 8.1Improper Authentication in Flask-AppBuilder
CVE-2024-27083Medium· 4.3Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
CVE-2023-29005High· 7.5Flask-AppBuilder Has No Rate Limiting on Login AUTH DB