CVE-2023-34110 Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user error
An authenticated admin can trigger database errors that expose sensitive user data, including hashed passwords, via the UI.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34110?
CVE-2023-34110 is a low-severity vulnerability in dpgaspar Flask-AppBuilder, published on 22 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.
Weakness: CWE-209
Which versions are affected by CVE-2023-34110?
3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
flask-appbuilder PyPI | All versions | 4.3.2 |
flask-appbuilder PyPI | All versions | 4.3.2 |
Flask-AppBuilder PyPI | All versions | 4.3.2 |
Products include Flask-Appbuilder Project Flask-Appbuilder.
How do I fix CVE-2023-34110?
Upgrade flask-appbuilder to 4.3.2 or later.
Is CVE-2023-34110 being exploited?
There is no known exploitation of CVE-2023-34110 in the wild and no public exploit code.
Sources
Also known as GHSA-jhpr-j7cq-3jp3, PYSEC-2023-94, ROOT-APP-PYPI-CVE-2023-34110.