CVE-2023-41891
LOW3.5EPSS 0.33%SQL Injection in List Endpoints in github.com/flyteorg/flyteadmin
Published: 10/27/2023Modified: 5/20/2024
Description
A malicious user can send a REST request to a List endpoint with filters that contain custom SQL statements. This can result in SQL injection.
Affected packages (2)
- Go/github.com/flyteorg/flyteadminfrom 0, < 1.1.124
- Go/github.com/flyteorg/flyteadminfrom 0, < 1.1.124
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.5 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N |
References (5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-41891
- PATCHhttps://github.com/flyteorg/flyteadmin
- WEBhttps://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd
- WEBhttps://github.com/flyteorg/flyteadmin/security/advisories/GHSA-r847-6w6h-r8g4
- WEBhttps://owasp.org/www-community/attacks/SQL_Injection#