Lucene search
GoogleOSV:GO-2022-1113HistoryDec 07, 2022 - 6:45 p.m.
Server-side request forgery in github.com/oam-dev/kubevela
2022-12-0718:45:56
Google
osv.dev
15
server-side request forgery
kubevela
helm chart
blind ssrf vulnerability
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
27.2%
When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/oam-dev/kubevela | ge | 1.6.0 | |
| github.com/oam-dev/kubevela | lt | 1.5.8 | |
| github.com/oam-dev/kubevela | lt | 1.6.1 |
Related
cvelist
cvelist
CVE-2022-39383 SSRF vulnerability in KubeVela VelaUX APIServer
2022-11-16 00:00:00
github
github
KubeVela VelaUX APIserver has SSRF vulnerability
2022-11-18 17:14:39
cve
cve
CVE-2022-39383
2022-11-16 20:15:10
osv
osv
KubeVela VelaUX APIserver has SSRF vulnerability
2022-11-18 17:14:39
CVE-2022-39383
2022-11-16 20:15:10
nvd
nvd
CVE-2022-39383
2022-11-16 20:15:10
prion
prion
Server side request forgery (ssrf)
2022-11-16 20:15:00
veracode
veracode
Server-Side Request Forgery (SSRF)
2022-11-17 05:55:53
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
27.2%
Related for OSV:GO-2022-1113