CVE-2022-24776

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known workarounds.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
dpgaspar	Flask-AppBuilder	< 3.4.5

References

https://github.com/dpgaspar/Flask-AppBuilder/pull/1804Patch, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5Release Notes, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpfThird Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/pull/1804Patch, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5Release Notes, Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpfThird Party Advisory

Timeline

Published: Mar 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247777.5grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2, a grpc-swift serve CVE-2022-247787.5The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line CVE-2022-24788.8Use after free in PDF in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2022-247808.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.6 and 3.0.0, users of the iTop user portal can send TWIG co CVE-2022-247817.1Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from other users, spoof t CVE-2022-247824.3Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior in the `beta` branch CVE-2022-2478310.0Deno is a runtime for JavaScript and TypeScript. The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an att CVE-2022-247843.7Statamic is a Laravel and Git powered CMS. Before versions 3.2.39 and 3.3.2, it is possible to confirm a single character of a user's passwo CVE-2022-247857.5Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts n CVE-2022-247869.8PJSIP is a free and open source multimedia communication library written in C. PJSIP versions 2.12 and prior do not parse incoming RTCP feed CVE-2022-247877.5Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes i CVE-2022-247889.8Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffe