Skip to content

No Rate Limiting on Login AUTH DB

Low
dpgaspar published GHSA-9hcr-9hcv-x6pv Apr 10, 2023

Package

pip Flask-AppBuilder (pip)

Affected versions

<4.3.0

Patched versions

4.3.0

Description

Impact

Lack of rate limiting will allow an attacker to brute-force user credentials

Patches

Ability to enable rate limiting on Flask-AppBuilder >= 4.3.0. Use AUTH_RATE_LIMITED = True and RATELIMIT_ENABLED = True set the limit itself by using AUTH_RATE_LIMIT more details on https://flask-limiter.readthedocs.io/en/stable/configuration.html. Will apply only to database authentication.

Workarounds

Implement rate limiting using a reverse proxy or other strategies.

Severity

Low
0.0
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

CVE ID

CVE-2023-29005

Weaknesses