PT-2022-20589 · Pypi · Flask-Appbuilder

Pgaspar · Published 2022-07-29 · Updated 2023-07-24 · CVE-2022-31177

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 4.1.3

Description An authenticated Admin user could query other users by their salted and hashed passwords strings, using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue is specific to the AUTH DB database authentication option.

Recommendations For versions prior to 4.1.3, upgrade to version 4.1.3 to resolve the issue. As a temporary workaround, consider restricting access to the user query functionality to minimize the risk of exploitation. Avoid using the AUTH DB database authentication option until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-916

CWE-200

Related Identifiers

CVE-2022-31177

GHSA-32FF-4G79-VGFC

PYSEC-2022-247

Affected Products

Flask-Appbuilder

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31177.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31177 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31177 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-247 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32ff-4g79-vgfc · Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder · Note
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc · Note
• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2022-247.yaml · Note
• https://t.me/cibsecurity/47365 · Telegram Post
• https://t.me/cvenotify/34110 · Telegram Post