AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

FlowiseGHSA-2q4w-x8h2-2fvh

Flowise Authentication Bypass vulnerability

Flowise

CVE-2024-8181 · Published Aug 27, 2024 · updated Sep 4, 2024

High7.3
No fix yet
GitHub advisory

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.

Affected versions

PackageAffectedFixed in
flowise
npm
<= 1.8.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-285, CWE-287
Also known as
CVE-2024-8181

More Flowise advisories

All Flowise
High 7.5Aug 27, 2024Flowise Unauthenticated Denial of Service (DoS) vulnerabilityCVE-2024-8182no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in api/v1/chatflows/idCVE-2024-36422no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in /api/v1/chatflows-streaming/idCVE-2024-37145no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in /api/v1/public-chatflows/idCVE-2024-36423no fix yetMedium 6.1Aug 5, 2024Flowise Cross-site Scripting in/api/v1/credentials/idCVE-2024-37146no fix yetHigh 7.5Aug 5, 2024Flowise Cors Misconfiguration in packages/server/src/index.tsCVE-2024-36421no fix yet