Low severity · published Aug 1, 2022
CVE-2022-31177
Possible to infer sensitive information through query strings in Flask-AppBuilder
2.7
CVSS
0.8%
EPSS
No
On KEV
Description
Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Flask-AppBuilder · dpgaspar
< 4.1.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31177
Release Notes
https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3
Third Party Advisory
https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc
More from Flask-AppBuilder
9.1
CVE-2024-25128
Flask-AppBuilder is an application development framework, built on top of Flask
8.8
CVE-2021-41265
Flask-AppBuilder is a development framework built on top of Flask
7.5
CVE-2023-29005
Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials
6.5
CVE-2025-58065
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
6.1
CVE-2025-32962
Flask-AppBuilder open redirect vulnerability using HTTP host injection