—

PYSEC-2021-851

Quick fix

PYSEC-2021-851 — flask-appbuilder: upgrade to the fixed version with the command below.

pip install --upgrade 'flask-appbuilder>=eba517aab121afa3f3f2edb011ec6bc4efd61fbc'

Details

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints. Users should upgrade to Flask-AppBuilder 3.3.4 to receive a patch.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/flask-appbuilder

Introduced in: 0Fixed in: eba517aab121afa3f3f2edb011ec6bc4efd61fbc

Fixpip install --upgrade 'flask-appbuilder>=eba517aab121afa3f3f2edb011ec6bc4efd61fbc'

References

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q[ADVISORY]
https://github.com/dpgaspar/Flask-AppBuilder/commit/eba517aab121afa3f3f2edb011ec6bc4efd61fbc[FIX]
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.3.4[WEB]