CVE-2024-27083

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-270856.5Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbit CVE-2024-270863.9The MSAL library enabled acquisition of security tokens to call protected APIs. MSAL.NET applications targeting Xamarin Android and .NET And CVE-2024-270875.4Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the en CVE-2024-270885.5es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into `function#copy` or `CVE-2024-27098.8A vulnerability was found in Tenda AC10U 15.03.06.49. It has been classified as critical. Affected is the function fromSetRouteStatic of the CVE-2024-270905.3Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and CVE-2024-270916.1GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within CVE-2024-270925.4Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send ema CVE-2024-270937.5Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to register a repository CVE-2024-270947.4OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating CVE-2024-270954.8Decidim is a participatory democracy framework. The admin panel is subject to potential XSS attach in case the attacker manages to modify so CVE-2024-270966.5GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.