CVE-2021-29621

Removed by vendor...

CVE-2021-29621

The vulnerability is in Flask-AppBuilder (a Flask-based development framework). A user-enumeration flaw exists in the database authentication flow, where an unauthenticated user can infer existing accounts by measuring login response timing. Affected versions are Flask-AppBuilder

CVE-2021-29621

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

CVE-2021-29621 Observable Response Discrepancy in Flask-AppBuilder

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

CVE-2021-29621: Observable Discrepancy

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version...

Flask-AppBuilder安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A user enumeration vulnerability exists in Flask- appbuilder, which can be exploited by an attacker to allow an unauthenticated user to enumerate existing accounts by timing the server's response time at login...

User Enumeration

flaskappbuilder is vulnerable to user enumeration. A remote unauthenticated attacker is able to enumerate existing accounts by observing the response time from the server...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2021-29621 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2021-29621 Source advisory: OSV:GHSA-434H-P4GX-JM89...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +6 more potentially affected by CVE-2021-29621 via flask-appbuilder (3.1.1)

flask-appbuilder PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - aglow =0.1.0rc3, =2022.9.19, =2.0.0b1, =1.4.0, =2.0.4 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plug...

Observable Response Discrepancy in Flask-AppBuilder

Impact User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Patches Upgrade to 3.3.0 For more information If you have any questions or commen...

GHSA-434H-P4GX-JM89 Observable Response Discrepancy in Flask-AppBuilder

Impact User enumeration in database authentication in Flask-AppBuilder = 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Patches Upgrade to 3.3.0 For more information If you have any questions or commen...

apache-airflow-backport-providers-papermill (>=2021.2.5rc1, <=2021.3.3) potentially affected by CVE-2021-29621 via flask-appbuilder (2.2.0)

flask-appbuilder PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow-backport-providers-papermill =2021.2.5rc1, =2021.3.3 Source cves: CVE-2021-29621 Source advisory:...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2021-29621 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2021-29621 Source advisory:...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2021-29621 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +6 more potentially affected by CVE-2021-29621 via flask-appbuilder (3.1.1)

flask-appbuilder PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - aglow =0.1.0rc3, =2022.9.19, =2.0.0b1, =1.4.0, =2.0.4 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plug...

PT-2021-18372 · Pypi · Flask-Appbuilder

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions 3.2.3 and earlier Description: The issue allows a non-authenticated user to enumerate existing accounts by timing the response time from the server when logging in. This is due to user enumeration in database...