Flask-AppBuilder security vulnerabilities

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.1.3, which stems from an authenticated administrator user being able to query other users via their salted and hashed password strings...

CVE-2022-31177: Exposure of Sensitive Information to an Unauthorized Actor

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2022-31177 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +98 more potentially affected by CVE-2022-31177 via flask-appbuilder (2.3.4)

flask-appbuilder PYPI version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.7rc1, =2020.5.20rc1, =2021.2.5rc1,...

apache-airflow (>=2.2.4rc1, <=2.2.5rc2), apilogicserver (>=5.2.15, <=5.3.33) potentially affected by CVE-2022-31177 via flask-appbuilder (3.4.4)

flask-appbuilder PYPI version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.2.4rc1, =5.2.15, =5.3.33 Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...

apache-airflow (>=2.3.3rc1, <=2.3.3) potentially affected by CVE-2022-31177 via flask-appbuilder (4.1.2)

flask-appbuilder PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.3.3rc1, =2.3.3 Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...

apache-airflow (>=1.10.3b1, <=1.10.3), dag-manager (>=0.1.3a0, <=0.1.5a0) +3 more potentially affected by CVE-2022-31177 via flask-appbuilder (1.12.3)

flask-appbuilder PYPI version 1.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =1.10.3b1, =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2022-31177 Source advisory:...

doc-tour (>=0.1.2, <=0.1.4) potentially affected by CVE-2022-31177 via flask-appbuilder (2.2.2)

flask-appbuilder PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - doc-tour =0.1.2, =0.1.4 Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

Impact An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), airflow-docker (>=1.0.0, <=1.1.0) +5 more potentially affected by CVE-2022-31177 via flask-appbuilder (1.13.1)

flask-appbuilder PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - airflow-clickhouse-plugin =0.5.1, =1.0.0, =1.10.0, =1.10.4b2, =1.10.6 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24....

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), airflow-add-ons (0.2.9b2) +16 more potentially affected by CVE-2022-31177 via flask-appbuilder (3.4.5)

flask-appbuilder PYPI version 3.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - acryl-datahub-airflow-plugin =0.8.44.4rc1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =2.0.2rc1, =0.0.4rc1, =0.0.0, =0.5.2, =0.8.3a...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +6 more potentially affected by CVE-2022-31177 via flask-appbuilder (3.1.1)

flask-appbuilder PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - aglow =0.1.0rc3, =2022.9.19, =2.0.0b1, =1.4.0, =2.0.4 - dataverk-airflow 0.3.12 - gps-building-blocks 1.2.2 - neuro-airflow-plug...

apache-airflow-backport-providers-papermill (>=2021.2.5rc1, <=2021.3.3) potentially affected by CVE-2022-31177 via flask-appbuilder (2.2.0)

flask-appbuilder PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow-backport-providers-papermill =2021.2.5rc1, =2021.3.3 Source cves: CVE-2022-31177 Source advisory:...

apilogicserver (>=3.1.15, <=4.0.6) potentially affected by CVE-2022-31177 via flask-appbuilder (3.3.0)

flask-appbuilder PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apilogicserver =3.1.15, =4.0.6 Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...

GHSA-32FF-4G79-VGFC Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

Impact An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes...

apache-airflow (>=2.3.3rc1, <=2.3.3) potentially affected by CVE-2022-31177 via flask-appbuilder (4.1.2)

flask-appbuilder PYPI version 4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - apache-airflow =2.3.3rc1, =2.3.3 Source cves: CVE-2022-31177 Source advisory: GHSA-32FF-4G79-VGFC...

PT-2022-20589 · Pypi · Flask-Appbuilder

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.1.3 Description: An authenticated Admin user could query other users by their salted and hashed passwords strings, using partial hashed password strings. The response would not include the hashed passwords...

Duplicate

This advisory duplicates another...

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and...

forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2022-24776 via flask-appbuilder (1.10.0)

flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2022-24776 Source advisory: OSV:GHSA-2CCW-7PX8-VMPF...