Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. There are no known workarounds for this issue.įlask-AppBuilder is a development framework built on top of Flask. Users are advised to upgrade to version 3.4.4 as soon as possible. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. In affected versions there exists a user enumeration vulnerability. There are currently no known workarounds.įlask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. There are no known workarounds for this issue.įlask-AppBuilder is an application development framework, built on top of the Flask web framework. This issue has been fixed in version 4.1.3. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. These filters could be made by using partial hashed password strings. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. If it’s a slow API or CPU intensive job - consider putting it in an async background job.Flask-AppBuilder is an application development framework built on top of Flask python framework. Or you may spin up a read-replica DB to steer read requests to it if you’ve reached a limit with vertical scaling of the DB server. In case if slow DB queries - use EXPLAIN to see if the server uses the index for querying the data. In my career I’ve encountered such situations: Only after identifying an underlying cause for slow responses, you can start dealing with them. So the best approach to work with them is to enable them on a development machine and run a test using ab, siege, or JMeter and analyze the results afterward.

In the settings there is a list of all requests where we can see that was passed to the server:īoth dashboards are meant to be used when Flask is in debug mode and I wouldn’t put them on in a production environment. On the overview page there is a statistics of our endpoint’s usage:

The dashboard is available under /flask-profile (default credentials are admin/admin)

The dashboard is also using SQLite by default (but MongoDB and SQLAlchemy are available backends).

Flask app builder