CVE-2024-0960CWE-502

flink-extended ai-flow workflow_command.py cloudpickle.loads deserialization

Medium · published January 27, 2024

CVSS v3.1
5.0
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads of the file \ai_flow\cli\commands\workflow_command.py. The manipulation leads to deserialization. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-252205 was assigned to this vulnerability.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00719 · 53.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-01-27T12:00Z
EPSS history
Timeline
  • 27 JAN 12:00Z
    flink-extended ai-flow workflow_command.py cloudpickle.loads deserialization
    cvelistv5