PT-2023-32482 · Prefect · Prefect

Bunchesofdonald · Publicado 2023-11-16 · Atualizado 2026-06-03 · CVE-2023-6022

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions prefect versions prior to 2.16.5

Description The issue allows an attacker to steal secrets and potentially gain remote code execution via Cross-Site Request Forgery (CSRF) using the Prefect API. This can be exploited in self-hosted, open source Prefect API setups.

Recommendations For versions prior to 2.16.5, update to version 2.16.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Prefect API to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-6022

GHSA-4HH5-2678-83FX

Produtos afetados

Prefect

Referências · 10

• 🔥 https://huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af · Exploit
• https://github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3 · Nota
• https://github.com/PrefectHQ/prefect/blob/main/RELEASE-NOTES.md#release-2165 · Nota
• https://github.com/prefecthq/prefect · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6022 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-6022 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-4hh5-2678-83fx · Aviso do Fabricante
• https://t.me/cvenotify/79845 · Publicação no Telegram
• https://t.me/cvenotify/61128 · Publicação no Telegram
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-6022 · Aviso do Fabricante