CVE-2022-31177: Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings
(updated )
An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users.
Only when using AUTH_DB database authentication option.
References
- github.com/advisories/GHSA-32ff-4g79-vgfc
- github.com/dpgaspar/Flask-AppBuilder
- github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3
- github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc
- github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2022-247.yaml
- nvd.nist.gov/vuln/detail/CVE-2022-31177
Code Behaviors & Features
Detect and mitigate CVE-2022-31177 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →