Is CVE-2022-31177 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-31177 being exploited in the wild.

How severe is CVE-2022-31177?

Low severity, with a CVSS score of 3.1, published 1 August 2022.

Which products and versions are affected?

flask-appbuilder (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.3.

Is there a fix for CVE-2022-31177?

Yes. flask-appbuilder (PyPI): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-31177 attacked?

It is attacked over the network.

Am I affected by CVE-2022-31177?

Check whether you run flask-appbuilder (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-31177: Flask-AppBuilder password hash inference via query filtering

CVE-2022-31177 · Severity: low · CVSS 3.1 · Published 2022-08-01

Flask-AppBuilder is a Python library for rapidly building web applications with admin dashboards. An authenticated admin user could craft search queries to infer partial password hashes of other users when using database authentication, potentially revealing user credential patterns and linking hashes to specific accounts without direct exposure of the full hash values.

Technologies: flask-appbuilder (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2022-31177 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-31177 being exploited in the wild.
How severe is CVE-2022-31177?: Low severity, with a CVSS score of 3.1, published 1 August 2022.
Which products and versions are affected?: flask-appbuilder (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.3.
Is there a fix for CVE-2022-31177?: Yes. flask-appbuilder (PyPI): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31177 attacked?: It is attacked over the network.
Am I affected by CVE-2022-31177?: Check whether you run flask-appbuilder (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

flask-appbuilder (PyPI): upgrade to 4.1.3 or later
```
pip install "flask-appbuilder>=4.1.3"
```

Technical details

The vulnerability is an information disclosure issue (CWE-200, CWE-916) in Flask-AppBuilder versions before 4.1.3 affecting only deployments using AUTH_DB (database) authentication. An authenticated admin user can craft HTTP requests with filter parameters to search for users by partial salted and hashed password strings. Although the HTTP response does not include the full hashed passwords, the success or failure of filter results allows an attacker to infer which partial password hashes correspond to which users. This requires admin-level authentication and is specific to database-backed authentication configurations. The vulnerability was patched in version 4.1.3.

Affected products

Flask-AppBuilder Flask-AppBuilder before 4.1.3

Identifiers

CVE-2022-31177
GHSA-32ff-4g79-vgfc
PYSEC-2022-247

Timeline

2022-07-29: disclosed
2022-07-29: patched: Fixed in version 4.1.3

References

https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.