Flask-AppBuilder versions prior to 4.3.0 lack rate limiting which can allow an malicious user to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting using `AUTH_RATE_LIMITED = True`, `RATELIMIT_ENABLED = True`, and setting an `AUTH_RATE_LIMIT`.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
flask-appbuilder project flask-appbuilder |
Vulmon