Skip to main content

Generation of Error Message Containing Sensitive Information

CVE-2023-34110

Low
2.7/10

Summary

Flask-AppBuilder is an application development framework, built on top of Flask. Versions prior to 4.3.2rc2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the "pbkdf2:sha256" hashed password.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • HIGH
  • LOW
  • NONE

CWE-209 - Generation of Error Message Containing Sensitive Information

The software generates an error message that includes sensitive information about its environment, users, or associated data.

References

Advisory Timeline

  • Published