CVE-2025-24023

LOW

Flask-AppBuilder < 4.5.3 - Unauthenticated Username Enumeration via Timing Attack

Title source: llm

Description

Flask-AppBuilder is an application development framework. Prior to 4.5.3, Flask-AppBuilder allows unauthenticated users to enumerate existing usernames by timing the response time from the server when brute forcing requests to login. This vulnerability is fixed in 4.5.3.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp

Scores

CVSS v3 3.7

EPSS 0.0032

EPSS Percentile 24.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-203 CWE-204

Status published

Products (2)

dpgaspar/flask-appbuilder < 4.5.3

pypi/flask-appbuilder 0 - 4.5.3PyPI

Published Mar 03, 2025

Tracked Since Feb 18, 2026