CVE-2022-21659: Observable Response Discrepancy in Flask-AppBuilder
Summary
CVE-2022-21659: Observable Response Discrepancy in Flask-AppBuilder. Affects flask-appbuilder versions < 3.4.4. Fixed in 3.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flask-AppBuilder is a Python package available on PyPI that provides a framework for building web applications. It offers various features and utilities to simplify the development process, including database authentication. However, versions prior to 3.4.4 are vulnerable to an observable response discrepancy, which can lead to user enumeration in the database authentication process. This vulnerability allows a non-authenticated user to determine the existence of user accounts by timing the response time from the server during login attempts.
Vulnerability Detail
The vulnerability arises from a timing discrepancy in the server's response when a user attempts to log in. By carefully measuring the response time, an attacker can determine whether a particular account exists in the database. This information can be leveraged for further attacks or unauthorized access. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-203.
How To Fix
Minimum fixed version
3.4.4
This is the first release that contains the fix.
pip install --upgrade "flask-appbuilder==3.4.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Flask-AppBuilder versions prior to 3.4.4 are vulnerable to an observable response discrepancy, which can lead to user enumeration. It is crucial to upgrade to version 3.4.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for flask-appbuilder →
FAQ
Flask-AppBuilder is a Python package that provides a framework for building web applications. It simplifies the development process by offering various features and utilities.
User enumeration is the process of determining the existence of user accounts in a system. In this vulnerability, an attacker can use timing discrepancies in the server's response to identify valid user accounts.
The vulnerability can allow an attacker to identify valid user accounts, which can be used for further attacks or unauthorized access. It is important to patch this vulnerability to prevent potential security breaches.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your Flask-AppBuilder version is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for flask-appbuilder.
