Detections
Analytics
SCA: security update for flask-appbuilder (GHSA-765j-9r45-w2q2)
medium Tenable Self-Hosted Container Security Plugin ID 435272
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is
configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint
remains registered and accessible, despite not being displayed in the user interface. This allows an
enabled user to reset their password and be able to create JWT tokens even after the user is disabled on
the authentication provider. Users should upgrade to Flask-AppBuilder version 4.8.1 or later to receive a
fix. If immediate upgrade is not possible, manually disable password reset routes in the application
configuration; implement additional access controls at the web server or proxy level to block access to
the reset my password URL; and/or monitor for suspicious password reset attempts from disabled accounts.
(CVE-2025-58065)
See Also
Plugin Details
Severity: Medium
ID: 435272
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 9/11/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.51
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N
CVSS Score Source: CVE-2025-58065
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/11/2025
Vulnerability Publication Date: 9/11/2025
Reference Information
CVE: CVE-2025-58065
cwe: CWE-287