CVE-2022-24856

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery (SSRF) when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or other unauthenticated URLs. Passing of headers to an unauthorized actor may occur. The patch for this issue deletes the entire `cors_proxy`, as this is not required for console anymore. A patch is available in FlyteConsole version 0.52.0. Disable FlyteConsole availability on the internet as a workaround.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-248578.8django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular CVE-2022-248586.1next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 CVE-2022-248595.5PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions pr CVE-2022-24869.8A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-b CVE-2022-248609.8Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-coded Cryptographic Key CVE-2022-248618.8Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability.CVE-2022-248627.7Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Request Forgery vulnerab CVE-2022-248637.5http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger pri CVE-2022-248645.4Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript CVE-2022-248656.5HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password by an administrator m CVE-2022-248664.3Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the Use CVE-2022-248677.5GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.