CVE-2022-21659 Observable Response Discrepancy in Flask-AppBuilder

What is CVE-2022-21659?

CVE-2022-21659 is a medium-severity vulnerability in n/a, published on 31 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Weakness: CWE-203

Which versions are affected by CVE-2022-21659?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2022-21659?

Upgrade flask-appbuilder to a fixed version for your release line: 3.4.2 or 3.4.4.

Is CVE-2022-21659 being exploited?

There is no known exploitation of CVE-2022-21659 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wfjw-w6pv-8p7f, PYSEC-2022-24.