PT-2022-24943 · Kubevela · Kubevela

Wangyikewxgm · Published 2022-11-16 · Updated 2022-12-07 · CVE-2022-39383

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions KubeVela versions 1.5 through 1.5.7 KubeVela versions 1.6 through 1.6.0

Description KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this issue. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability.

Recommendations For versions 1.5 through 1.5.7, update to version 1.5.8 or later. For versions 1.6 through 1.6.0, update to version 1.6.1 or later. As a temporary workaround, consider restricting the request address of the warehouse when using Helm Chart as the component delivery method until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-39383

GHSA-M5XF-X7Q6-3RM7

GO-2022-1113

Affected Products

Kubevela

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39383.json · Exploit
• https://github.com/kubevela/kubevela/pull/5000 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39383 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39383 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m5xf-x7q6-3rm7 · Vendor Advisory
• https://github.com/kubevela/kubevela · Note
• https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7 · Note
• https://t.me/cvenotify/38097 · Telegram Post
• https://t.me/cvenotify/37908 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-1113 · Note