GHSA-fw5r-6m3x-rh7pMediumCVSS 3.6

Flask-AppBuilder's login form allows browser to cache sensitive fields

Published
September 4, 2024
Last Modified
November 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-45314 →

📋 Description

Impact

Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.

Patches

Upgrade flask-appbuilder to version 4.5.1

Workarounds

If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"

🎯 Affected products1

  • pip/flask-appbuilder:< 4.5.1

🔗 References (4)