CVE-2022-31177

    Dashboard / Vulnerabilities / CVE-2022-31177

    CVE-2022-31177

    Published: 1 Aug 2022Last Modified: 12 Aug 2026

    Summary: Possible to infer sensitive information through query strings in Flask-AppBuilder

    Details: Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

    References: https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31177.json, https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc, https://nvd.nist.gov/vuln/detail/CVE-2022-31177

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4ac9bba008e404b9a1e783cd272c81bb8634de3d

    Affected versions

    v4.1.2
    v4.1.1
    v4.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31177 | CVE-DB