PrefectHQ prefect WebSocket Endpoint in missing authentication
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 6.9epss 0.4%
probabilidade de exploração
0.4%top 65% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
PrefectHQ · prefectPoCs públicas encontradas — 1
cve_referencegist.github.com/nedlir/f1ab8aa038aafbcc6beeef21fab1d74fnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://gist.github.com/nedlir/f1ab8aa038aafbcc6beeef21fab1d74fhttps://github.com/PrefectHQ/prefect/https://github.com/PrefectHQ/prefect/commit/f8afecadf88ea5f73694dafa3a365b9d8fae1ad6https://github.com/PrefectHQ/prefect/pull/20372https://github.com/PrefectHQ/prefect/releases/tag/3.6.14https://vuldb.com/submit/807256https://vuldb.com/vuln/360899https://vuldb.com/vuln/360899/cti