CVE-2022-21659

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-203

Affected software

No affected versions have been published.

Timeline

Published
Jan 31, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-21669.8Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0.CVE-2022-216608.1Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higheCVE-2022-216617.5WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitizatioCVE-2022-216625.4WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticateCVE-2022-216637.2WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with CVE-2022-216648.8WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitCVE-2022-216667.2Useful Simple Open-Source CMS (USOC) is a content management system (CMS) for programmers. Versions prior to Pb2.4Bfx3 allowed Sql injectionCVE-2022-216677.5soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if itCVE-2022-216688.6pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of rCVE-2022-216697.5PuddingBot is a group management bot. In version 0.0.6-b933652 and prior, the bot token is publicly exposed in main.py, making it accessibleCVE-2022-21676.1The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leaCVE-2022-216705.3markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down