CVE-2021-29621: Observable Response Discrepancy in Flask-AppBuilder
Impact User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.
Patches Upgrade to 3.3.0
For more information If you have any questions or comments about this advisory: Open an issue in Flask-AppBuilder
Other sources
Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-29621?
CVE-2021-29621 is a vulnerability in Flask-AppBuilder <= 3.2.3 that allows a non-authenticated user to enumerate existing accounts by timing the response time from the server during login.
What is the severity of CVE-2021-29621?
The severity of CVE-2021-29621 is medium with a CVSS score of 5.3.
How does CVE-2021-29621 affect Flask-AppBuilder?
CVE-2021-29621 affects Flask-AppBuilder versions up to and including 3.2.3.
How can I fix CVE-2021-29621?
To fix CVE-2021-29621, upgrade Flask-AppBuilder to version 3.3 or higher.
Is Apache Airflow affected by CVE-2021-29621?
Yes, Apache Airflow version 1.10.0 is also affected by CVE-2021-29621.