CVE:CVE-2021-29621
CNNVD:CNNVD-202106-412
Flask-AppBuilder是一个简单快速的应用程序开发框架。
Flask- appbuilder 存在安全漏洞，该漏洞源于Flask-AppBuilder <= 3.2.3缺少身份验证措施或身份验证强度不足。攻击者可利用该漏洞允许未经身份验证的用户在登录时通过计时服务器的响应时间枚举现有帐户。
solution:Upgrade flask-appbuilder_project flask-appbuilder to a higher version than 3.2.3,and avoid the version (,3.2.3]; Upgrade apache airflow to a higher version than 1.10.0,and avoid the version 1.10.0