Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.
References
| Link | Resource |
|---|---|
| https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ | Exploit Third Party Advisory |
| https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L982 | Product |
Configurations
History
03 Jul 2024, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Flowiseai
Flowiseai flowise |
|
| CWE | CWE-74 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:flowiseai:flowise:1.4.3:*:*:*:*:*:*:* | |
| References | () https://securitylab.github.com/advisories/GHSL-2023-232_GHSL-2023-234_Flowise/ - Exploit, Third Party Advisory | |
| References | () https://github.com/FlowiseAI/Flowise/blob/e93ce07851cdc0fcde12374f301b8070f2043687/packages/server/src/index.ts#L982 - Product |
01 Jul 2024, 16:37
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-01 16:15
Updated : 2024-07-03 15:29
NVD link : CVE-2024-36420
Mitre link : CVE-2024-36420
JSON object : View
Products Affected
flowiseai
- flowise
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')