{"cve":"CVE-2022-21659","nvd":{"published":"2022-01-31T21:15:09.013","modified":"2026-06-17T04:26:42.283","status":"Modified","description":"Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerability allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Users are advised to upgrade to version 3.4.4 as soon as possible. There are no known workarounds for this issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-203"],"references":["https://github.com/dpgaspar/Flask-AppBuilder/pull/1775","https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-wfjw-w6pv-8p7f","https://github.com/dpgaspar/Flask-AppBuilder/pull/1775","https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-wfjw-w6pv-8p7f"],"products":["dpgaspar:flask-appbuilder"],"source":"nvd","synced_at":"2026-10-19T21:27:20.926095847+00:00"},"epss":{"cve":"CVE-2022-21659","score":0.00953,"percentile":0.61349,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-wfjw-w6pv-8p7f","url":"https://osv.dev/vulnerability/GHSA-wfjw-w6pv-8p7f","summary":"Observable Response Discrepancy in Flask-AppBuilder","modified":"2026-09-10T03:49:12.893858485Z","packages":[{"ecosystem":"PyPI","name":"flask-appbuilder","purl":"pkg:pypi/flask-appbuilder","ranges":["<3.4.4"],"fixed":["3.4.4"]}]},{"id":"PYSEC-2022-24","url":"https://osv.dev/vulnerability/PYSEC-2022-24","summary":"","modified":"2023-11-08T04:08:06.563816Z","packages":[{"ecosystem":"PyPI","name":"flask-appbuilder","purl":"pkg:pypi/flask-appbuilder","ranges":["<3.4.2"],"fixed":["3.4.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}