cve/2023/CVE-2023-34110.md

### [CVE-2023-34110](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34110)
![](https://img.shields.io/static/v1?label=Product&message=Flask-AppBuilder&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%204.3.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-209%3A%20Generation%20of%20Error%20Message%20Containing%20Sensitive%20Information&color=brighgreen)

### Description

Flask-AppBuilder is an application development framework, built on top of Flask. Prior to version 4.3.2, an authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password. This vulnerability has been fixed in version 4.3.2.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/msegoviag/discovered-vulnerabilities
- https://github.com/msegoviag/msegoviag