FlowiseGHSA-66f2-xxgm-f6xp
Flowise Cors Misconfiguration in packages/server/src/index.ts
High7.5CVE-2024-36421 · Published Aug 5, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | <= 1.4.3 | No fix yet |
Details and references
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-346
- Also known as
- CVE-2024-36421
More Flowise advisories
All Flowise| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 52024 | Flowise Path Injection at /api/v1/openai-assistants-file CVE-2024-36420High7.5no fix yet | High7.5 | No fix yet |
| Aug 52024 | Flowise Cross-site Scripting in api/v1/chatflows/id CVE-2024-36422Medium6.1no fix yet | Medium6.1 | No fix yet |
| Aug 52024 | Flowise Cross-site Scripting in /api/v1/chatflows-streaming/id CVE-2024-37145Medium6.1no fix yet | Medium6.1 | No fix yet |
| Aug 52024 | Flowise Cross-site Scripting in /api/v1/public-chatflows/id CVE-2024-36423Medium6.1no fix yet | Medium6.1 | No fix yet |
| Aug 52024 | Flowise Cross-site Scripting in/api/v1/credentials/id CVE-2024-37146Medium6.1no fix yet | Medium6.1 | No fix yet |
| Aug 272024 | Flowise Authentication Bypass vulnerability CVE-2024-8181High7.3no fix yet | High7.3 | No fix yet |