CVE-2021-29621

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions 3.2.3 and earlier

Description The issue allows a non-authenticated user to enumerate existing accounts by timing the response time from the server when logging in. This is due to user enumeration in database authentication in Flask-AppBuilder.

Recommendations For versions 3.2.3 and earlier, upgrade to version 3.3.0 or higher to resolve the issue. As a temporary workaround, consider restricting access to the login functionality to minimize the risk of exploitation.