CVE-2022-21659 — Observable Discrepancy in Flask-appbuilder

CWE-203 — Observable DiscrepancyCWE-204 — Observable Response Discrepancy5 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.3%
top 43.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Dpgaspar Flask-appbuilder
Timeline
PublishedJan 31
Latest updateFeb 1

Description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Observable Response Discrepancy in Flask-AppBuilder↗2022-02-01
▶
GHSA
Observable Response Discrepancy in Flask-AppBuilder↗2022-02-01
▶
CVEList
Observable Response Discrepancy in Flask-AppBuilder↗2022-01-31
▶
OSV
CVE-2022-21659: Flask-AppBuilder is an application development framework, built on top of the Flask web framework↗2022-01-31
▶
CVE-2022-21659 — Observable Discrepancy | cvebase