CVE-2022-31177

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-200

• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3Release Notes, Third Party Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfcThird Party Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3Release Notes, Third Party Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfcThird Party Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31170OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31171Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-31172OpenZeppelin Contracts is a library for smart contract devel…7.5
• CVE-2022-31173Juniper is a GraphQL server library for Rust. Affected versi…7.5
• CVE-2022-31175CKEditor 5 is a JavaScript rich text editor. A cross-site sc…4.7
• CVE-2022-31176Grafana Image Renderer is a Grafana backend plugin that hand…8.1
• CVE-2022-31178eLabFTW is an electronic lab notebook manager for research t…4.3
• CVE-2022-31179Shescape is a simple shell escape package for JavaScript. Ve…9.8
• CVE-2022-3118A vulnerability was found in Sourcecodehero ERP System Proje…9.8
• CVE-2022-31180Shescape is a simple shell escape package for JavaScript. Af…9.8
• CVE-2022-31181PrestaShop is an Open Source e-commerce platform. In version…9.8
• CVE-2022-31182Discourse is the an open source discussion platform. In affe…5.3