CVE-2022-39383

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
kubevela	kubevela	>= 1.6.0, < 1.6.1; < 1.5.9

References

https://github.com/kubevela/kubevela/pull/5000Patch, Third Party Advisory
https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7Third Party Advisory
https://github.com/kubevela/kubevela/pull/5000Patch, Third Party Advisory
https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7Third Party Advisory

Timeline

Published: Nov 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-393845.6OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that CVE-2022-393856.5Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to sever CVE-2022-393867.5@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed pac CVE-2022-393877.5XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider CVE-2022-393883.5Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can imperso CVE-2022-393896.5Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are CVE-2022-39399.8A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of CVE-2022-393927.4Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of its pooling instanc CVE-2022-393938.6Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pool CVE-2022-393949.8Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementation where the defini CVE-2022-393959.9Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior CVE-2022-393969.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.18, and prior