# CVE-2022-31177: Flask-AppBuilder password hash inference via query filtering

Source: https://junglewise.ai/threats/cve-2022-31177-flask-appbuilder-password-hash-inference-via-query-filtering  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-08-01. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-31177 · Severity: low · CVSS 3.1 · Published 2022-08-01

Flask-AppBuilder is a Python library for rapidly building web applications with admin dashboards. An authenticated admin user could craft search queries to infer partial password hashes of other users when using database authentication, potentially revealing user credential patterns and linking hashes to specific accounts without direct exposure of the full hash values.

Technologies: [flask-appbuilder (PyPI)](https://junglewise.ai/threats/technologies/flask-appbuilder). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-31177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31177 being exploited in the wild.

**How severe is CVE-2022-31177?** Low severity, with a CVSS score of 3.1, published 1 August 2022.

**Which products and versions are affected?** flask-appbuilder (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.3.

**Is there a fix for CVE-2022-31177?** Yes. flask-appbuilder (PyPI): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-31177 attacked?** It is attacked over the network.

**Am I affected by CVE-2022-31177?** Check whether you run flask-appbuilder (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- flask-appbuilder (PyPI): upgrade to 4.1.3 or later

  ```sh
  pip install "flask-appbuilder>=4.1.3"
  ```


## Technical details

The vulnerability is an information disclosure issue (CWE-200, CWE-916) in Flask-AppBuilder versions before 4.1.3 affecting only deployments using AUTH_DB (database) authentication. An authenticated admin user can craft HTTP requests with filter parameters to search for users by partial salted and hashed password strings. Although the HTTP response does not include the full hashed passwords, the success or failure of filter results allows an attacker to infer which partial password hashes correspond to which users. This requires admin-level authentication and is specific to database-backed authentication configurations. The vulnerability was patched in version 4.1.3.

## Affected products

- Flask-AppBuilder Flask-AppBuilder before 4.1.3

## Identifiers

- CVE-2022-31177
- GHSA-32ff-4g79-vgfc
- PYSEC-2022-247

## Timeline

- 2022-07-29: disclosed
- 2022-07-29: patched: Fixed in version 4.1.3

## References

- [https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc](https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc)

## Related threats

- [PYSEC-2026-1378 - Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods](https://junglewise.ai/threats/cve-2025-58065-flask-app-builder-has-an-authentication-bypass-vulnerability-when)
- [PYSEC-2026-1379 - Flask-AppBuilder open redirect vulnerability using HTTP host injection](https://junglewise.ai/threats/cve-2025-32962-flask-appbuilder-open-redirect-vulnerability-using-http-host)
- [PYSEC-2026-1382 - Flask-AppBuilder's login form allows browser to cache sensitive fields](https://junglewise.ai/threats/cve-2024-45314-flask-appbuilder-s-login-form-allows-browser-to-cache-sensitive)
- [PYSEC-2026-1381 - Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)](https://junglewise.ai/threats/cve-2024-27083-flask-appbuilder-s-oauth-login-page-subject-to-cross-site)
- [PYSEC-2026-1380 - Flask-AppBuilder Has No Rate Limiting on Login AUTH DB](https://junglewise.ai/threats/cve-2023-29005-flask-appbuilder-has-no-rate-limiting-on-login-auth-db)