Log in Start free

Vulnerability · Published Jan 31, 2022 · Assigned by GitHub_M

CVE-2022-21659Observable Response Discrepancy in Flask-AppBuilder

Medium 5.3

In plain English

A medium-severity security flaw in the flask-appbuilder package (PyPI). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.0%top 38.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIflask-appbuilder3.4.4GHSA-wfjw-w6pv-8p7f
PyPIflask-appbuilder3.4.2PYSEC-2022-24

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References