CVE-2024-45314: Flask-AppBuilder's login form allows browser to cache sensitive fields

September 4, 2024 (updated November 18, 2024)

Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.

References

github.com/advisories/GHSA-fw5r-6m3x-rh7p
github.com/dpgaspar/Flask-AppBuilder
github.com/dpgaspar/Flask-AppBuilder/commit/3030e881d2e44f4021764e18e489fe940a9b3636
github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fw5r-6m3x-rh7p
nvd.nist.gov/vuln/detail/CVE-2024-45314

Code Behaviors & Features

Detect and mitigate CVE-2024-45314 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →