CVE-2021-29621CWE-203

Observable Response Discrepancy in Flask-AppBuilder

Medium · published June 7, 2021

CVSS v3.1
5.3
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03404 · 88.8th percentile
Weakness
CWE-203 · Observable Discrepancy
Published
2021-06-07T19:00Z
EPSS history
Timeline
  • 07 JUN 19:00Z
    Observable Response Discrepancy in Flask-AppBuilder
    cvelistv5