CVE-2024-45314 json
Flask-AppBuilder login form allows browser to cache sensitive fields
published 2024-09-04 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2784 , GHSA-fw5r-6m3x-rh7p , PYSEC-2026-1382
- cvss
- 3.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for `/login` per the directions provided in the GitHub Security Advisory.
Patch / fix
- pypi flask-appbuilder 4.5.1
- dpgaspar flask-appbuilder 4.5.1
- dpgaspar flask_app_builder 4.5.1
- flask-appbuilder_project flask-appbuilder 4.5.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 3.6 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | flask-appbuilder | <4.5.1 |
4.5.1 |
Affected products
- dpgaspar Flask-AppBuilder
Classification
- Weakness
-
- CWE-525 Use of Web Browser Cache Containing Sensitive Information
References
-
github.com
/dpgaspar/Flask-AppBuilder/commit/3030e881d2e44f4021764e18e489fe940a9b3636
web, patch
-
github.com
/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fw5r-6m3x-rh7p
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-45314
advisory
-
github.com
/dpgaspar/Flask-AppBuilder
package
-
pypi.org
/project/flask-appbuilder
package
-
github.com
/advisories/GHSA-fw5r-6m3x-rh7p
advisory
Sources
- CVE List CVE-2024-45314
- GitHub Advisory GHSA-fw5r-6m3x-rh7p
- NVD CVE-2024-45314
- OSV PYSEC-2026-1382
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.