GitHub Advisoryadvisory · PyPI

GHSA-4v9f-r55g-g6hc Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

HIGH Published 2025-03-20 Modified 2025-03-26 Official page ↗
Aliases
CVE-2024-8183
Ecosystem
PyPI
Packages
prefect
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-346
Reviewed
2025-03-20

Affected packages

• PyPI prefect: >= 3.0.0rc1, < 3.0.3 → fixed in 3.0.3 • PyPI prefect: < 2.20.17 → fixed in 2.20.17

Description

A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.

Related

Alias · CVE (1)

  • CVE-2024-8183 A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive… vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References