KubeVela VelaUX APIserver has SSRF vulnerability

🗓️ 18 Nov 2022 17:14:39Reported by GitHub Advisory DatabaseType

KubeVela VelaUX APIserver has SSRF vulnerability. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2

Reporter	Title	Published	Views	Family All 15
CNNVD	KubeVela 代码问题漏洞	16 Nov 202200:00	–	cnnvd
CVE	CVE-2022-39383	16 Nov 202200:00	–	cve
Cvelist	CVE-2022-39383 SSRF vulnerability in KubeVela VelaUX APIServer	16 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-7380	3 Oct 202520:07	–	euvd
NVD	CVE-2022-39383	16 Nov 202220:15	–	nvd
OSV	CGA-G59R-X45F-R5F6	6 Jun 202412:27	–	osv
OSV	CGA-R59F-CJ6H-534P	29 Jan 202600:48	–	osv
OSV	CVE-2022-39383 SSRF vulnerability in KubeVela VelaUX APIServer	16 Nov 202200:00	–	osv
OSV	GHSA-M5XF-X7Q6-3RM7 KubeVela VelaUX APIserver has SSRF vulnerability	18 Nov 202217:14	–	osv
OSV	GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela	7 Dec 202218:45	–	osv

Vulners

Node

oam-dev kubevelaRange1.6.0-alpha.1–1.6.2go

oam-dev kubevelaRange<1.5.9go

Source	Link
github	www.github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-39383
github	www.github.com/kubevela/kubevela/pull/5000
pkg	www.pkg.go.dev/vuln/GO-2022-1113
github	www.github.com/advisories/GHSA-m5xf-x7q6-3rm7

29 Aug 2023 22:52Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.14.9 - 6.5

EPSS0.00207

SSVC

CWE-918

kubevela velaux apiserver ssrf vulnerability helm chart blind 1.5.9 1.6.2