GoogleOSV:CVE-2022-39383CVE-2022-39383
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
27.2%
KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who’re using v1.6, please update the v1.6.1. Users who’re using v1.5, please update the v1.5.8. There are no known workarounds for this issue.
| CPE | Name | Operator | Version |
|---|---|---|---|
| kubevela | eq | 1.5.0-beta.7 | |
| kubevela | eq | 1.1.2 | |
| kubevela | eq | 0.0.1.2 | |
| kubevela | eq | 0.3.2 | |
| kubevela | eq | 1.2.0-rc.2 | |
| kubevela | eq | 1.3.0 | |
| kubevela | eq | 1.5.0-beta.2 | |
| kubevela | eq | 1.1.0-beta.2 | |
| kubevela | eq | 1.5.2 | |
| kubevela | eq | 1.0.0-rc1 |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
27.2%