FlyteAdmin SQL Injection in List Filters
CVE-2023-41891

3.5LOW

Key Information:

Vendor

Flyteorg

Status
Flyteadmin
Vendor
CVE Published:
30 October 2023

What is CVE-2023-41891?

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

Affected Version(s)

flyteadmin < 1.1.124

References

https://github.com/flyteorg/flyteadmin/security/advisorie...
x_refsource_CONFIRM
https://github.com/flyteorg/flyteadmin/commit/b3177ef70f0...
x_refsource_MISC
https://owasp.org/www-community/attacks/SQL_Injection#
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.