CVE-2023-41891 - CVE House
Back to Database
Status published Low CVE-2023-41891

FlyteAdmin SQL Injection in List Filters

Vulnerability Description

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-41891

Credits & Attribution

No credits recorded in the NVD database.

References

More from flyteorg

View All →
CVE-2022-39273
Default OAuth Authorization Server secret in FlyteAdmin
Medium 4.8
CVE-2022-31145
Insufficient AccessToken Expiration Check in FlyteAdmin
Medium 6.5
CVE-2022-24856
Server-Side Request Forgery in FlyteConsole
Critical 9.1

Affected Vendor

Affected Software

flyteadmin
Vulnerable Versions:
< 1.1.124

Timeline

Official Publish: October 30th, 2023
Last Modified: September 6th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact