CVE-2023-29005
highpriority · track · 30EPSS 0.006 · 50 %ileEUUSEPSS · scored 2026-10-27
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-9hcr-9hcv-x6pvFlask-AppBuilder Has No Rate Limiting on Login AUTH DB2023-04-10ghsa · osvUS
### Impact Lack of rate limiting will allow an attacker to brute-force user credentials. ### Patches Ability to enable rate limiting on Flask-AppBuilder >= 4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication. ### Workarounds Implement rate limiting using a reverse proxy or other strategies.
- PYSEC-2026-1380Flask-AppBuilder Has No Rate Limiting on Login AUTH DB2026-07-07vendor · osvUS
### Impact Lack of rate limiting will allow an attacker to brute-force user credentials. ### Patches Ability to enable rate limiting on Flask-AppBuilder >= 4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication. ### Workarounds Implement rate limiting using a reverse proxy or other strategies.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-29005/cnnvd
- https://flask-limiter.readthedocs.io/en/stable/configuration.htmlcnnvd
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pvcnnvd
- https://flask-limiter.readthedocs.io/en/stable/configuration.htmlenisa_euvd
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pvenisa_euvd
- https://flask-limiter.readthedocs.io/en/stable/configuration.htmlProductnvd
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-9hcr-9hcv-x6pvVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan