Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2022-39383

Good to know:

icon

Date: November 15, 2022

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.

Language: Go

Severity Score

Related Resources (6)

https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7
https://github.com/kubevela/kubevela
https://nvd.nist.gov/vuln/detail/CVE-2022-39383
https://pkg.go.dev/vuln/GO-2022-1113
https://github.com/kubevela/kubevela/pull/5000
https://www.mend.io/vulnerability-database/CVE-2022-39383

Severity Score

Weakness Type (CWE)

Server-Side Request Forgery (SSRF)

CWE-918

Top Fix

icon

Upgrade Version

Upgrade to version v1.5.9,v1.6.1

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us