CVE-2022-31177 Possible to infer sensitive information through query strings in Flask-AppBuilder

What is CVE-2022-31177?

CVE-2022-31177 is a low-severity vulnerability in dpgaspar Flask-AppBuilder, published on 1 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-200

Which versions are affected by CVE-2022-31177?

3 open source packages ship an affected version, including flask-appbuilder and Flask-AppBuilder. It affects 1 product.

Products include Dpgaspar Flask-Appbuilder.

How do I fix CVE-2022-31177?

Upgrade flask-appbuilder to 4.1.3 or later.

Is CVE-2022-31177 being exploited?

There is no known exploitation of CVE-2022-31177 in the wild and no public exploit code.

Other vulnerabilities in dpgaspar Flask-AppBuilder

• CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID Critical 9.1
• CVE-2021-41265 Improper Authentication in Flask-AppBuilder High 8.1
• CVE-2023-29005 No Rate Limiting on Login AUTH DB High 7.5
• CVE-2021-32805 URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder High 7.2
• CVE-2025-58065 Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-32ff-4g79-vgfc, PYSEC-2022-247.