GHSL-2023-234: GHSL-2023-232_GHSL-2023-234: Path injection, Cross-Site Scripting (XSS) and CORS misconfiguration in Flowise - CVE-2024-36420, CVE-2024-36421, CVE-2024-36422, CVE-2024-36423, CVE-2024-37145, CVE-2024-37146
Flowise is vulnerable to path injection, cross site scripting and CORS misconfiguration vulnerabilities, that may compromise the confidentiality of the information on the host server. In the worst case, it may allow attackers to read files from the Flowise server and read/modify user secrets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of GHSL-2023-234?
GHSL-2023-234 has a risk score of 60, indicating a moderate vulnerability impact.
How do I fix GHSL-2023-234?
To fix GHSL-2023-234, update Flowise to the latest version that addresses the path injection, XSS, and CORS misconfiguration vulnerabilities.
What types of vulnerabilities are included in GHSL-2023-234?
GHSL-2023-234 includes path injection, cross-site scripting, and CORS misconfiguration vulnerabilities.
What information can be compromised due to GHSL-2023-234?
GHSL-2023-234 may allow attackers to read sensitive files from the Flowise server and access or modify user secrets.
When was GHSL-2023-234 published?
GHSL-2023-234 was published on June 28, 2024.