PT-2024-38861 · Flowise · Flowise

Joshua Martinelle · Published 2024-08-27 · Updated 2024-08-31 · CVE-2024-8182

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Flowise version 1.8.2

Description: An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise, leading to a complete crash of the instance running a vulnerable version due to improper handling of user-supplied input to the "/api/v1/get-upload-file" API endpoint.

Recommendations: For Flowise version 1.8.2, as a temporary workaround, consider restricting access to the "/api/v1/get-upload-file" API endpoint until a patch is available. Additionally, avoid using this endpoint with untrusted user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-8182

GHSA-48X4-MX8F-GR4H

Affected Products

Flowise

References · 13

• https://osv.dev/vulnerability/CVE-2024-8182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8182 · Security Note
• https://osv.dev/vulnerability/GHSA-48x4-mx8f-gr4h · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://t.me/latest_high_impact_cve/1063 · Telegram Post
• https://t.me/cvedetector/4241 · Telegram Post
• https://twitter.com/CVEnew/status/1828422157916934344 · Twitter Post
• https://twitter.com/cracbot/status/1829398782196199453 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1828444287761096709 · Twitter Post
• https://t.me/cvenotify/92812 · Telegram Post
• https://twitter.com/cracbot/status/1829761166555419085 · Twitter Post
• https://tenable.com/security/research/tra-2024-34 · Note
• https://twitter.com/cracbot/status/1830123481599484157 · Twitter Post