CVE-2025-58065
BaseFortify
Publication date: 2025-09-11
Last updated on: 2025-09-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dpgaspar | flask-appbuilder | to 4.8.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Flask-AppBuilder versions prior to 4.8.1 when using OAuth, LDAP, or other non-database authentication methods. The password reset endpoint remains accessible even though it is not shown in the user interface. This allows an enabled user to reset their password and generate JWT tokens even after their account has been disabled on the authentication provider.
How can this vulnerability impact me? :
The vulnerability can allow users who have been disabled on the authentication provider to still reset their passwords and create JWT tokens, potentially enabling unauthorized access or actions within the application despite being disabled.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious password reset attempts from disabled accounts targeting the password reset endpoint. Since the password reset endpoint remains accessible even when not shown in the UI, you can check web server or application logs for requests to the password reset URL. Specific commands depend on your logging setup, but for example, using grep on access logs to find password reset attempts: grep 'reset_password' /path/to/access.log. Additionally, monitoring authentication logs for password reset activity from disabled users can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Flask-AppBuilder to version 4.8.1 or later. If upgrading is not immediately possible, manually disable the password reset routes in the application configuration, implement additional access controls at the web server or proxy level to block access to the password reset URL, and monitor for suspicious password reset attempts from disabled accounts.