GitHub Advisoryadvisory · Go

GHSA-r847-6w6h-r8g4 Flyte Admin SQL Injection in List Filters

LOW Published 2023-10-27 Modified 2023-10-27 Official page ↗
Aliases
CVE-2023-41891
Ecosystem
Go
Packages
github.com/flyteorg/flyteadmin
Severity
Low
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-89
Reviewed
2023-10-27

Affected packages

• Go github.com/flyteorg/flyteadmin: < 1.1.124 → fixed in 1.1.124

Description

Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters. Workarounds The attacker needs to have access to the flyteadmin installation (typically either behind a VPN or authentication). References https://owasp.org/www-community/attacks/SQL_Injection#

Related

Alias · CVE (1)

  • CVE-2023-41891 FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References