CVE-2023-29005

Published: Apr 10, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.

Affected (1)

Products: Dpgaspar: Flask Appbuilder

1 product

Flask Appbuilder

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dpgaspar Flask Appbuilder	Before 4.3.0

Related CWEs

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (4)

https://flask-limiter.readthedocs.io/en/stable/configuration.html

Source: security-advisories@github.com

Product

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv

Source: security-advisories@github.com

Vendor Advisory

https://flask-limiter.readthedocs.io/en/stable/configuration.html

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pv

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.