CVE-2021-29621 — Observable Discrepancy in Flask-appbuilder

CWE-203 — Observable Discrepancy5 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.4%
top 37.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dpgaspar Flask-appbuilderApache Airflow
Timeline
PublishedJun 7

Description

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5dpgaspar/flask-appbuilder< 3.3.0
▶NVDapache/airflow1.10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
CVE-2021-29621: Flask-AppBuilder is a development framework, built on top of Flask↗2021-06-07
▶
CVEList
Observable Response Discrepancy in Flask-AppBuilder↗2021-06-07
▶
OSV
Observable Response Discrepancy in Flask-AppBuilder↗2021-05-27
▶
GHSA
Observable Response Discrepancy in Flask-AppBuilder↗2021-05-27
▶
CVE-2021-29621 — Observable Discrepancy | cvebase