PT-2022-15013

CVE-2022-21659

Published

2022-01-31

Updated

2022-02-07

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Flask-AppBuilder versions prior to 3.4.4

Description The issue concerns a user enumeration vulnerability in Flask-AppBuilder, an application development framework built on top of the Flask web framework. This vulnerability allows a non-authenticated user to enumerate existing accounts by timing the response time from the server when logging in.

Recommendations For versions prior to 3.4.4, upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-204: Observable Response Discrepancy

CWE-203: Observable Discrepancy

Related identifiers