CVE-2022-39383

 

Published at: - 16-11-2022 09:15

Last modified: - 18-11-2022 11:45

Total changes: - 2

Description

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7
• https://github.com/kubevela/kubevela/pull/5000

 

Keywords

NVD

 

CVE-2022-39383

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures