CVE-2022-31177

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-311784.3eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a temCVE-2022-311799.8Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. ThiCVE-2022-31189.8A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some unknown processing ofCVE-2022-311809.8Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when intCVE-2022-311819.8PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulCVE-2022-311825.3Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error CVE-2022-311839.8fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameteCVE-2022-311847.5Discourse is the an open source discussion platform. In affected versions an email activation route can be abused to send mass spam emails. CVE-2022-311855.3mprweb is a hosting platform for the makedeb Package Repository. Email addresses were found to not have been hidden, even if a user had clicCVE-2022-311863.3NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-autCVE-2022-311875.4GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service DCVE-2022-311889.8CVAT is an opensource interactive video and image annotation tool for computer vision. Versions prior to 2.0.0 were found to be subject to a
CVE-2022-31177: Low severity, CVSS 2.7 | Vulnix