CVE-2022-24856: flyte console

csirt@kutim:~/threat-intel/cve/CVE-2022-24856

CVSS 7.5 · High EPSS 10,5%

Kerentanan Server-Side Request Forgery (SSRF) pada flyte console. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround.

Rincian

Terbit di NVD: 17 Mei 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 10,5% peluang dieksploitasi; lebih tinggi dari 95,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
flyte	flyte console	Semua versi sebelum 0.52.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/flyteorg/flyteconsole/commit/05b88ed2d2ecdb5d8a8404efea25414e57189709 patch · advisory pihak ketiga
https://github.com/flyteorg/flyteconsole/pull/389 patch · advisory pihak ketiga
https://github.com/flyteorg/flyteconsole/releases/tag/v0.52.0 advisory pihak ketiga
https://github.com/flyteorg/flyteconsole/security/advisories/GHSA-www6-hf2v-v9m9 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.