CVE-2021-29621 MEDIUM

CVE-2021-29621: Observable Response Discrepancy in Flask-AppBuilder

Vendor Dpgaspar
Product Flask-AppBuilder
Weakness CWE-203
Published June 7, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.

Key dates

02Disclosure timeline

June 7, 2021 CVE published
August 3, 2024 Record updated