acryl-datahub-airflow-plugin (>=0.8.44.4 <=0.9.2.1rc2), aglow (>=0.1.0rc3 <=0.1.0rc4) +130 more potentially affected by CVE-2022-31177 via flask-appbuilder (>=1.10.0 <=4.1.2)

flask-appbuilder PYPI version =1.10.0, =0.8.44.4, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.2.0, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.0.3, =0.0.6, =0.0.1, =0.0.3 and more Source cves: CVE-2022-31177 Source advisory: OSV:PYSEC-2022-247...

PYSEC-2022-247

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177

CVE-2022-31177 affects Flask-AppBuilder versions prior to 4.1.3. An authenticated Admin could query other users by their salted and hashed password strings using partial hashed password strings. The server would not return full hashes, but an attacker could infer partial password hashes and their...

CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

CVE-2022-31177

Removed by vendor...

CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The...

Information Disclosure

Flask-AppBuilder is vulnerable to information disclosure. The vulnerability exists due to the HTTP response indicating the hashed passwords insecurely, allowing attackers to infer the partial password hashes through the malicious query strings...

Flask-AppBuilder 安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.1.3, which stems from an authenticated administrator user being able to query other users via their salted and hashed password strings...

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

Impact An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes...

GHSA-32FF-4G79-VGFC Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

Impact An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes...

acryl-datahub-airflow-plugin (>=0.8.44.4 <=0.9.2.1rc2), aglow (>=0.1.0rc3 <=0.1.0rc4) +130 more potentially affected by CVE-2022-31177 via flask-appbuilder (>=1.10.0 <=4.1.2)

flask-appbuilder PYPI version =1.10.0, =0.8.44.4, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.2.0, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.0.3, =0.0.6, =0.0.1, =0.0.3 and more Source cves: CVE-2022-31177 Source advisory: OSV:GHSA-32FF-4G79-VGFC...

Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings

An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and...

PT-2022-20589 · Pypi · Flask-Appbuilder

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.1.3 Description: An authenticated Admin user could query other users by their salted and hashed passwords strings, using partial hashed password strings. The response would not include the hashed passwords...

Duplicate

This advisory duplicates another...

GHSA-2CCW-7PX8-VMPF Open Redirect in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later. For more...

aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +113 more potentially affected by CVE-2022-24776 via flask-appbuilder (>=1.10.0 <=3.4.4)

flask-appbuilder PYPI version =1.10.0, =0.1.0rc3, =0.1.0, =2022.9.19, =1.0.7, =0.5.1, =0.1.0, =1.0.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =1.10.0, =1.10.3, =2.2.5rc2 and more Source cves: CVE-2022-24776 Source advisory: OSV:GHSA-2CCW-7PX8-VMPF...

Open Redirect in Flask-AppBuilder

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later. For more...

CVE-2022-24776

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database authentication login page on versions below 3.4.5. This issue is fixed in version 3.4.5. There are currently no known...