CVE-2024-25128 CRITICAL

CVE-2024-25128: Flask-AppBuilder incorrect authentication when using auth type OpenID

Vendor Dpgaspar
Product Flask-AppBuilder
Weakness CWE-287 · Improper authentication
Published February 28, 2024
Last update August 26, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend. This vulnerability is only exploitable when the application is using the OpenID 2.0 authorization protocol. Upgrade to Flask-AppBuilder 4.3.11 to fix the vulnerability.

Key dates

02Disclosure timeline

February 28, 2024 CVE published
August 26, 2024 Record updated