How severe is CVE-2022-31177?

This vulnerability has a severity rating of LOW with a CVSS score of 2.7 out of 10.

What type of vulnerability is CVE-2022-31177?

This is classified as CWE-200, which is a common weakness in software security.

CVE-2022-31177 - LOW Severity | CVSS 2.7

Vulnerability Description

Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could query other users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users. This issue has been fixed in version 4.1.3. Users are advised to upgrade. There are no known workarounds for this issue.

Related Vulnerabilities

CVE-2016-2947

LOW

CVSS:2.7(Low)

IBM Rational Collaborative Lifecycle Management 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18,...

CWE-2002016

CVE-2016-3021

LOW

CVSS:2.7(Low)

IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.

CWE-2002016

CVE-2017-10194

LOW

CVSS:2.7(Low)

Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supported version that is affected is Prior to 3....

CWE-2002017

CVE-2017-20031

LOW

CVSS:2.7(Low)

A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument sortby with the input pass...

CWE-2002017

CVE-2018-0109

LOW

CVSS:2.7(Low)

A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to obtain info...

CWE-2002018

CVE-2018-10423

LOW

CVSS:2.7(Low)

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article.

CWE-2002018