CVE-2021-29621: Observable Response Discrepancy in Flask-AppBuilder
Summary
CVE-2021-29621: Observable Response Discrepancy in Flask-AppBuilder. Affects flask-appbuilder versions < 3.3.0. Fixed in 3.3.0. How to fix ↓
Also tracked for
- airflow · Bitnami
The same CVE-2021-29621 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a Python package that provides a framework for building web applications. It offers various features and utilities to simplify the development process, including database authentication. However, versions up to 3.2.3 of Flask-AppBuilder are vulnerable to user enumeration attacks. This vulnerability allows an unauthorized user to determine the existence of user accounts by exploiting timing discrepancies in the server's response during the login process.
Vulnerability Detail
The vulnerability in Flask-AppBuilder <= 3.2.3 enables an attacker to enumerate existing accounts through timing analysis. By measuring the response time from the server during login attempts, an unauthorized user can determine if an account exists or not. This information can be leveraged for further attacks or unauthorized access. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
3.3.0
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==3.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Flask-AppBuilder versions up to 3.2.3 are vulnerable to user enumeration attacks, allowing unauthorized users to determine the existence of user accounts. To mitigate this vulnerability, it is essential to upgrade to Flask-AppBuilder 3.3.0 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-appbuilder →
FAQ
Flask-AppBuilder is a Python package that provides a framework for building web applications. It simplifies the development process by offering various features and utilities.
User enumeration is a technique used to determine the existence of user accounts in a system. In this vulnerability, an attacker can exploit timing discrepancies in the server's response to identify whether an account exists or not.
The vulnerability allows unauthorized users to enumerate existing accounts, which can be leveraged for further attacks or unauthorized access. It compromises the confidentiality of user information and undermines the security of the application.
To mitigate the risk, it is crucial to upgrade Flask-AppBuilder to version 3.3.0 or later. This update includes patches that address the user enumeration vulnerability.
No specific workaround is mentioned for this vulnerability. It is recommended to upgrade to the patched version as the primary solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
