GitHub Advisoryadvisory · PyPI

GHSA-wfjw-w6pv-8p7f Observable Response Discrepancy in Flask-AppBuilder

MEDIUM Published 2022-02-01 Modified 2025-03-07 Official page ↗
Aliases
CVE-2022-21659
Ecosystem
PyPI
Packages
Flask-AppBuilder
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-203, CWE-204
Reviewed
2022-01-31

Affected packages

• PyPI Flask-AppBuilder: < 3.4.4 → fixed in 3.4.4

Description

Impact User enumeration in database authentication in Flask-AppBuilder < 3.4.4. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Patches Upgrade to 3.4.4 Workarounds References For more information If you have any questions or comments about this advisory: • Open an issue in example link to repo • Email us at example email address

Related

Alias · CVE (1)

  • CVE-2022-21659 Flask-AppBuilder is an application development framework, built on top of the Flask web framework. vulnerability

Weakness · CWE (2)

  • CWE-203 Observable Discrepancy weakness
  • CWE-204 Observable Response Discrepancy weakness

References