CVE-2024-8183: CORS Misconfiguration in prefecthq/prefect
First published: Thu Mar 20 2025(Updated: )
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Prefect | ||
| pip/prefect | <2.20.17 | 2.20.17 |
| pip/prefect | >=3.0.0rc1<3.0.3 | 3.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/prefecthq/prefect/commit/a69266e077169b8a32ad76b1dd3ea63b96d011c2
- https://huntr.com/bounties/b801de43-ff9f-4db9-b583-4797d4f7d3d2
- https://nvd.nist.gov/vuln/detail/CVE-2024-8183
- https://github.com/PrefectHQ/prefect/issues/15074
- https://github.com/PrefectHQ/prefect/commit/8f159b404126d93964a4daace7619bc553fa318c
- https://github.com/advisories/GHSA-4v9f-r55g-g6hc (Advisory)
- https://github.com/PrefectHQ/prefect/releases/tag/2.20.17
Frequently Asked Questions
What is the severity of CVE-2024-8183?
CVE-2024-8183 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2024-8183?
To mitigate CVE-2024-8183, review and update your CORS configurations to ensure only trusted domains have access.
What type of attack does CVE-2024-8183 enable?
CVE-2024-8183 enables CORS misconfiguration attacks, allowing unauthorized domains to access sensitive data.
Which versions of Prefect are affected by CVE-2024-8183?
CVE-2024-8183 affects Prefect version 2.20.2 and possibly earlier versions that share the same CORS misconfiguration.
Can CVE-2024-8183 lead to data leaks?
Yes, CVE-2024-8183 can lead to data leaks and loss of confidentiality due to unauthorized domain access.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/nvd-cve
- agent/source
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- source/GitHub
- alias/GHSA-4v9f-r55g-g6hc
- alias/CVE-2024-8183
- agent/tags
- collector/github-advisory-latest
- vendor/prefecthq
- canonical/prefect
- package-manager/pip