CVE-2023-41891

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-41891

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41891.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-41891

Aliases

Published

2023-10-30T18:01:17.453Z

Modified

2026-02-16T02:52:59.088050Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

FlyteAdmin SQL Injection in List Filters

Details

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on FlyteAdmin have a SQL vulnerability where a malicious user can send a REST request with custom SQL statements as list filters. The attacker needs to have access to the FlyteAdmin installation, typically either behind a VPN or authentication. Version 1.1.124 contains a patch for this issue.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41891.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/flyteorg/flyteadmin

Affected ranges

Type: GIT
Repo: https://github.com/flyteorg/flyteadmin
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1df2d185d18df03ba3004b5c12171ef1229961a0

Affected versions

0.*

0.1.5

v0.*

v0.1.0

v0.1.1

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.17

v0.3.18

v0.3.19

v0.3.2

v0.3.20

v0.3.21

v0.3.22

v0.3.23

v0.3.24

v0.3.25

v0.3.26

v0.3.27

v0.3.28

v0.3.29

v0.3.3

v0.3.30

v0.3.31

v0.3.32

v0.3.33

v0.3.34

v0.3.35

v0.3.36

v0.3.37

v0.3.38

v0.3.39

v0.3.4

v0.3.40

v0.3.41

v0.3.42

v0.3.43

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.2

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.10

v0.6.100

v0.6.101

v0.6.102

v0.6.103

v0.6.104

v0.6.105

v0.6.106

v0.6.107

v0.6.108

v0.6.109

v0.6.11

v0.6.110

v0.6.111

v0.6.112

v0.6.113

v0.6.114

v0.6.115

v0.6.116

v0.6.117

v0.6.118

v0.6.119

v0.6.12

v0.6.120

v0.6.121

v0.6.122

v0.6.123

v0.6.124

v0.6.125

v0.6.126

v0.6.127

v0.6.128

v0.6.129

v0.6.13

v0.6.130

v0.6.131

v0.6.132

v0.6.133

v0.6.134

v0.6.135

v0.6.136

v0.6.137

v0.6.138

v0.6.139

v0.6.14

v0.6.140

v0.6.141

v0.6.142

v0.6.143

v0.6.144

v0.6.145

v0.6.146

v0.6.147

v0.6.148

v0.6.149

v0.6.15

v0.6.150

v0.6.16

v0.6.17

v0.6.18

v0.6.19

v0.6.2

v0.6.20

v0.6.21

v0.6.22

v0.6.23

v0.6.24

v0.6.25

v0.6.26

v0.6.27

v0.6.28

v0.6.29

v0.6.3

v0.6.30

v0.6.31

v0.6.32

v0.6.33

v0.6.34

v0.6.35

v0.6.36

v0.6.37

v0.6.38

v0.6.39

v0.6.4

v0.6.40

v0.6.41

v0.6.42

v0.6.43

v0.6.44

v0.6.45

v0.6.46

v0.6.47

v0.6.48

v0.6.49

v0.6.5

v0.6.50

v0.6.51

v0.6.52

v0.6.53

v0.6.54

v0.6.55

v0.6.56

v0.6.57

v0.6.58

v0.6.59

v0.6.6

v0.6.60

v0.6.61

v0.6.62

v0.6.63

v0.6.64

v0.6.65

v0.6.66

v0.6.67

v0.6.68

v0.6.69

v0.6.7

v0.6.70

v0.6.71

v0.6.72

v0.6.73

v0.6.74

v0.6.75

v0.6.76

v0.6.77

v0.6.78

v0.6.79

v0.6.8

v0.6.80

v0.6.81

v0.6.82

v0.6.84

v0.6.85

v0.6.86

v0.6.87

v0.6.88

v0.6.89

v0.6.9

v0.6.90

v0.6.91

v0.6.92

v0.6.93

v0.6.94

v0.6.95

v0.6.96

v0.6.97

v0.6.98

v0.6.99

v1.*

v1.0.0

v1.0.1

v1.1.0

v1.1.1

v1.1.10

v1.1.100

v1.1.101

v1.1.102

v1.1.103

v1.1.104

v1.1.105

v1.1.106

v1.1.107

v1.1.108

v1.1.109

v1.1.11

v1.1.110

v1.1.111

v1.1.112

v1.1.113

v1.1.114

v1.1.115

v1.1.116

v1.1.117

v1.1.118

v1.1.119

v1.1.12

v1.1.120

v1.1.121

v1.1.122

v1.1.123

v1.1.13

v1.1.14

v1.1.15

v1.1.16

v1.1.17

v1.1.18

v1.1.19

v1.1.2

v1.1.20

v1.1.21

v1.1.22

v1.1.23

v1.1.24

v1.1.25

v1.1.26

v1.1.27

v1.1.28

v1.1.29

v1.1.3

v1.1.30

v1.1.31

v1.1.32

v1.1.33

v1.1.34

v1.1.35

v1.1.36

v1.1.37

v1.1.38

v1.1.39

v1.1.4

v1.1.40

v1.1.41

v1.1.42

v1.1.43

v1.1.44

v1.1.45

v1.1.46

v1.1.47

v1.1.48

v1.1.49

v1.1.5

v1.1.50

v1.1.51

v1.1.52

v1.1.53

v1.1.54

v1.1.55

v1.1.56

v1.1.57

v1.1.58

v1.1.59

v1.1.6

v1.1.60

v1.1.61

v1.1.62

v1.1.63

v1.1.64

v1.1.65

v1.1.66

v1.1.67

v1.1.68

v1.1.69

v1.1.7

v1.1.70

v1.1.71

v1.1.72

v1.1.73

v1.1.74

v1.1.75

v1.1.76

v1.1.77

v1.1.78

v1.1.79

v1.1.8

v1.1.80

v1.1.81

v1.1.82

v1.1.83

v1.1.84

v1.1.85

v1.1.86

v1.1.87

v1.1.88

v1.1.89

v1.1.9

v1.1.90

v1.1.91

v1.1.92

v1.1.93

v1.1.94

v1.1.95

v1.1.96

v1.1.97

v1.1.98

v1.1.99

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-41891.json"