What is CVE-2024-27083?

CVE-2024-27083 is a medium-severity vulnerability in Dpgaspar Flask-Appbuilder, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2024-02-29.

How severe is CVE-2024-27083?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-27083 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Dpgaspar Flask-Appbuilder

CVE-2024-27083

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (43.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.

Affected products

Dpgaspar Flask-appbuilder — versions >= 4.1.4, < 4.2.1

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2024-27083?: CVE-2024-27083 is a medium-severity vulnerability in Dpgaspar Flask-Appbuilder, classified under Cross-site Scripting. CVSS score: 4.3/10. Published 2024-02-29.
How severe is CVE-2024-27083?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-27083 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.