Vulnerability Description
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dpgaspar | Flask-Appbuilder | < 4.1.3 |
Related Weaknesses (CWE)
References
- https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3Release NotesThird Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-Third Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3Release NotesThird Party Advisory
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-Third Party Advisory
FAQ
What is CVE-2022-31177?
CVE-2022-31177 is a vulnerability with a CVSS score of 2.7 (LOW). Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hash...
How severe is CVE-2022-31177?
CVE-2022-31177 has been rated LOW with a CVSS base score of 2.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31177?
Check the references section above for vendor advisories and patch information. Affected products include: Dpgaspar Flask-Appbuilder.