Описание
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using AUTH_RATE_LIMITED = True, RATELIMIT_ENABLED = True, and setting an AUTH_RATE_LIMIT.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | DNE | |
| devel | DNE | |
| esm-infra/focal | DNE | |
| focal | DNE | |
| jammy | DNE | |
| kinetic | ignored | end of life, was needs-triage |
| lunar | DNE | |
| trusty | ignored | end of standard support |
| upstream | released | 4.3.0 |
| xenial | ignored | end of standard support |
Показывать по
7.5 High
CVSS3
Связанные уязвимости
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can al ...
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB
7.5 High
CVSS3