CVE-2024-45314
Flask-AppBuilder login form allows browser to cache sensitive fields
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for /login per the directions provided in the GitHub Security Advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Flask-AppBuilder login form allows browser to cache sensitive fields
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for /login per the directions provided in the GitHub Security Advisory.
- Record
CVE-2024-45314- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-02
EUVDEUVD-2024-2784
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for /login per the directions provided in the GitHub Security Advisory.
- Record
EUVD-2024-2784- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fw5r-6m3x-rh7p
Flask-AppBuilder's login form allows browser to cache sensitive fields
Impact
Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.
Patches
Upgrade flask-appbuilder to version 4.5.1
Workarounds
If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"
- Record
GHSA-fw5r-6m3x-rh7p- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-02
NVD
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for /login per the directions provided in the GitHub Security Advisory.
- Record
CVE-2024-45314- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-02
OSV
Flask-AppBuilder login form allows browser to cache sensitive fields
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources. Version 4.5.1 contains a patch for this issue. If upgrading is not possible, configure one's web server to send the specific HTTP headers for /login per the directions provided in the GitHub Security Advisory.
- Record
CVE-2024-45314- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-02
OSVGHSA-fw5r-6m3x-rh7p
Flask-AppBuilder's login form allows browser to cache sensitive fields
Impact
Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.
Patches
Upgrade flask-appbuilder to version 4.5.1
Workarounds
If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"
- Record
GHSA-fw5r-6m3x-rh7p- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-02
OSVPYSEC-2026-1382
Flask-AppBuilder's login form allows browser to cache sensitive fields
Impact
Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.
Patches
Upgrade flask-appbuilder to version 4.5.1
Workarounds
If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"
- Record
PYSEC-2026-1382- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N - CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flask-appbuilderPyPI |
before 4.5.1 | 4.5.1 |
flask-appbuilderPyPI |
before 4.5.1, plus listed versions 0.1.100.1.110.1.120.1.130.1.14 Show 45 moreShow less0.1.150.1.160.1.170.1.180.1.190.1.200.1.210.1.220.1.230.1.240.1.250.1.260.1.270.1.280.1.290.1.30.1.330.1.340.1.350.1.360.1.370.1.380.1.40.1.430.1.440.1.450.1.460.1.470.1.50.1.60.1.70.1.80.1.90.10.00.10.10.10.20.10.30.10.40.10.50.10.60.10.70.2.00.2.10.2.20.3.0 |
4.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45314 is a low vulnerability (CVSS 3.6) in Dpgaspar Flask-appbuilder, published September 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in flask-appbuilder 4.5.1.
References
github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fw5r-6m3x-rh7p
nvd.nist.gov/vuln/detail/CVE-2024-45314
pypi.org/project/flask-appbuilder
Left out here: 271 versions. The JSON record has them.