CVE-2022-31177: falha de baixa gravidade em dpgaspar Flask-AppBuilder
Possible to infer sensitive information through query strings in Flask-AppBuilder
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 2.7epss 0.8%
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
dpgaspar · Flask-AppBuilderCVEs relacionadas — dpgaspar Flask-AppBuilder
No mesmo produto, das mais perigosas para as menos.
CVE-2021-29621MEDIUMObservable Response Discrepancy in Flask-AppBuilderEPSS 3.4%CVE-2021-41265HIGHImproper Authentication in Flask-AppBuilderEPSS 1.3%CVE-2022-24776MEDIUMOpen Redirect in Flask-AppBuilderEPSS 1.0%CVE-2024-25128CRITICALFlask-AppBuilder incorrect authentication when using auth type OpenID EPSS 0.9%CVE-2021-32805HIGHURL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilderEPSS 0.7%CVE-2023-34110LOWFlask-AppBuilder vulnerable to possible disclosure of sensitive information on user errorEPSS 0.7%