CVE-2022-21659 MEDIUM

CVE-2022-21659: Observable Response Discrepancy in Flask-AppBuilder

Vendor N/A
Product n/a
Published January 31, 2022
Last update May 5, 2025
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

January 31, 2022 CVE published
May 5, 2025 Record updated