VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 7, 2021· Updated Aug 3, 2024

Observable Response Discrepancy in Flask-AppBuilder

CVE-2021-29621

Description

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Flask-AppBuilderPyPI
< 3.3.03.3.0

Affected products

1

Patches

1
780bd0e8fbf2

fix: auth balance (#1634)

https://github.com/dpgaspar/Flask-AppBuilderDaniel Vaz GasparMay 10, 2021via ghsa
commit
1 file changed · +6 −0
  • flask_appbuilder/security/manager.py+6 −0 modified
    @@ -833,6 +833,12 @@ def auth_user_db(self, username, password):
         if user is None:
             user = self.find_user(email=username)
         if user is None or (not user.is_active):
+            # Balance failure and success
+            check_password_hash(
+                "pbkdf2:sha256:150000$Z3t6fmj2$22da622d94a1f8118"
+                "c0976a03d2f18f680bfff877c9a965db9eedc51bc0be87c",
+                "password",
+            )
             log.info(LOGMSG_WAR_SEC_LOGIN_FAILED.format(username))
             return None
         elif check_password_hash(user.password, password):

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.