CVE-2023-29005
on GitHub
Published
Severity
CVSS v3:
7.5 HIGH
CVSS v2:
N/A
Description
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
References
Configurations
| CPE23 | Version Start | Version End | Exact Version |
|---|---|---|---|
| cpe:2.3:a:flask-appbuilder_project:flask-appbuilder:*:*:*:*:*:*:*:* | n/a | 4.3.0 | * |
| cpe:2.3:a:dpgaspar:flask-appbuilder:*:*:*:*:*:*:*:* | n/a | 4.3.0 | * |