Lucene search

TenableCVELIST:CVE-2024-9148

HistorySep 24, 2024 - 1:13 p.m.

CVE-2024-9148 Flowise Stored Cross-Site Scripting

2024-09-2413:13:13

CWE-79

tenable

www.cve.org

flowise

stored cross-site scripting

chat embed

vulnerability

input sanitization

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

Percentile

9.6%

JSON

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

CNA Affected

[
  {
    "collectionURL": "https://www.npmjs.com/package/flowise-embed",
    "defaultStatus": "unaffected",
    "packageName": "flowise-embed",
    "product": "FlowiseChatEmbed",
    "repo": "https://github.com/FlowiseAI/FlowiseChatEmbed",
    "vendor": "FlowiseAI",
    "versions": [
      {
        "lessThan": "2.0.0",
        "status": "affected",
        "version": "0",
        "versionType": "npm"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2024-40

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS

Percentile

9.6%

JSON

Related for CVELIST:CVE-2024-9148