What is GHSA-p8q5-cvwx-wvwp?

GHSA-p8q5-cvwx-wvwp is a security advisory published by GitHub Security Advisories with Low severity. Flask-AppBuilder Observable Response Discrepancy

Which CVE IDs does GHSA-p8q5-cvwx-wvwp cover?

GHSA-p8q5-cvwx-wvwp covers the following CVE IDs: CVE-2025-24023. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p8q5-cvwx-wvwp?

GHSA-p8q5-cvwx-wvwp has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

Which products are affected by GHSA-p8q5-cvwx-wvwp?

GHSA-p8q5-cvwx-wvwp affects 1 product, including: pip/flask-appbuilder:\u003c 4.5.3.

GHSA-p8q5-cvwx-wvwpLowCVSS 3.7

Flask-AppBuilder Observable Response Discrepancy

Vendor

GitHub Security Advisories

Published

March 3, 2025

Last Modified

April 9, 2025

🔗 CVE IDs covered (1)

CVE-2025-24023 →

📋 Description

Impact

User enumeration in database authentication in Flask-AppBuilder <= 4.5.3 and werkzeug >= 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login.

Patches

Upgrade to flask-appbuilder>=4.5.3

Workarounds

Downgrade werkzeug to <3.0.0

References

Are there any links users can visit to find out more?

🎯 Affected products1

pip/flask-appbuilder:< 4.5.3

🔗 References (4)

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-p8q5-cvwx-wvwp
https://nvd.nist.gov/vuln/detail/CVE-2025-24023
https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2025-15.yaml
https://github.com/advisories/GHSA-p8q5-cvwx-wvwp