CVE-2023-41891CWE-89

FlyteAdmin SQL Injection in List Filters

Low · published October 30, 2023

CVSS v3.1
3.5
EPSS
1%
Percentile
60.2
In the wild
Unconfirmed
What it is

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00929 · 60.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2023-10-30T18:01Z
EPSS history
Timeline
  • 30 OCT 18:01Z
    FlyteAdmin SQL Injection in List Filters
    cvelistv5