CVE-2024-27083: Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)

February 28, 2024 (updated April 1, 2025)

A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user’s browser.

Impacted versions: Flask-AppBuilder version 4.1.4 up to and including 4.2.0

References

github.com/advisories/GHSA-fqxj-46wg-9v84
github.com/dpgaspar/Flask-AppBuilder
github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812
github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84
nvd.nist.gov/vuln/detail/CVE-2024-27083

Code Behaviors & Features

Detect and mitigate CVE-2024-27083 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →