{"id":"CVE-2024-27083","aliases":["GHSA-fqxj-46wg-9v84","PYSEC-2026-1381"],"url":"https://o3.security/vulnerability/CVE-2024-27083","summary":"Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)","details":"### Impact\nA Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser.\n\nImpacted versions:\nFlask-AppBuilder version 4.1.4 up to and including 4.2.0\n\n### Patches\nThis issue was introduced on 4.1.4 and patched on 4.2.1, user's should upgrade to 4.2.1 or newer versions.","published":"2024-02-28T15:34:02.490Z","modified":"2026-08-12T03:51:49.380725059Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"},"epss":{"score":0.00567,"percentile":0.4446,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"flask-appbuilder","fixedVersion":"4.2.1"}],"fix":{"url":"https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812","label":"dpgaspar/Flask-AppBuilder@3d17741"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27083.json"},{"type":"ADVISORY","url":"https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27083"},{"type":"FIX","url":"https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812"},{"type":"PACKAGE","url":"https://github.com/dpgaspar/Flask-AppBuilder"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:49.380725059Z"}}