Vulnerability Details CVE-2021-29621
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 52.0%
CVSS Severity
CVSS v3 Score 5.3
CVSS v2 Score 5.0
References
- https://github.com/dpgaspar/Flask-AppBuilder/commit/780bd0e8fbf2d36ada52edb769477e0a4edae580
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-434h-p4gx-jm89
- https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r5b754118ba4e996adf03863705d34168bffec202da5c6bdc9bf3add5%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r91067f953906d93aaa1c69fe2b5472754019cc6bd4f1ba81349d62a0%40%3Ccommits.airflow.apache.org%3E
- https://pypi.org/project/Flask-AppBuilder/
- https://github.com/dpgaspar/Flask-AppBuilder/commit/780bd0e8fbf2d36ada52edb769477e0a4edae580
- https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-434h-p4gx-jm89
- https://lists.apache.org/thread.html/r466759f377651f0a690475d5a52564d0e786e82c08d5a5730a4f8352%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r5b754118ba4e996adf03863705d34168bffec202da5c6bdc9bf3add5%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r91067f953906d93aaa1c69fe2b5472754019cc6bd4f1ba81349d62a0%40%3Ccommits.airflow.apache.org%3E
- https://pypi.org/project/Flask-AppBuilder/
Products affected by CVE-2021-29621
-
cpe:2.3:a:apache:airflow:1.10.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:-
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.10.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.11.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.11.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.12.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.12.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.12.2
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.12.3
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.12.4
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.12.5
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.13.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.13.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.8.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.2
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.3
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.4
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.5
-
cpe:2.3:a:dpgaspar:flask-appbuilder:1.9.6
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.0.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.10
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.11
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.12
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.13
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.2
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.3
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.4
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.5
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.6
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.7
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.8
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.1.9
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.2.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.2.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.2.2
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.2.3
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.2.4
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.3.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.3.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.3.2
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.3.3
-
cpe:2.3:a:dpgaspar:flask-appbuilder:2.3.4
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.0.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.0.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.1.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.1.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.2.0
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.2.1
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.2.2
-
cpe:2.3:a:dpgaspar:flask-appbuilder:3.2.3