GitHub Advisoryadvisory · npm

GHSA-2q4w-x8h2-2fvh Flowise Authentication Bypass vulnerability

HIGH Published 2024-08-27 Modified 2024-09-04 Official page ↗
Aliases
CVE-2024-8181
Ecosystem
npm
Packages
flowise
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-285, CWE-287
Reviewed
2024-08-27

Affected packages

• npm flowise: <= 1.8.2 (no fix yet)

Description

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.

Related

Alias · CVE (1)

  • CVE-2024-8181 An Authentication Bypass vulnerability exists in Flowise version 1.8.2. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-287 Improper Authentication weakness

References