CVE-2023-41891

Katalog CVE

CVSS 8.8 · High EPSS 0,93%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada flyteadmin. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

Rincian

Terbit di NVD

30 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,93% peluang dieksploitasi; lebih tinggi dari 59,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd patch · advisory pihak ketiga
• https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4 advisory pihak ketiga
• https://owasp.org/www-community/attacks/SQL_Injection# advisory pihak ketiga