PT-2022-15013 · Unknown · Flask-Appbuilder

Sam Wheating · Published 2022-01-31 · Updated 2022-02-07 · CVE-2022-21659

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 3.4.4

Description The issue concerns a user enumeration vulnerability in Flask-AppBuilder, an application development framework built on top of the Flask web framework. This vulnerability allows a non-authenticated user to enumerate existing accounts by timing the response time from the server when logging in.

Recommendations For versions prior to 3.4.4, upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-204

CWE-203

Related Identifiers

CVE-2022-21659

GHSA-WFJW-W6PV-8P7F

PYSEC-2022-24

Affected Products

Flask-Appbuilder

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21659.json · Exploit
• https://github.com/dpgaspar/Flask-AppBuilder/pull/1775 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-24 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wfjw-w6pv-8p7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21659 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21659 · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://github.com/dpgaspar/Flask-AppBuilder/commit/e2b744c258ff62ece9d5ac7172c3b4644ff4c2fe · Note
• https://github.com/dpgaspar/Flask-AppBuilder/commits/v3.4.4 · Note
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-wfjw-w6pv-8p7f · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2022-24.yaml · Note
• https://t.me/cvenotify/26392 · Telegram Post
• https://t.me/cibsecurity/36603 · Telegram Post