An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code
    via a crafted script to the api/v1 component. (CVE-2024-31621)

Flowise versions prior to 1.6.6 are vulnerable to an authentication bypass allowing a remote and unauthenticated attacker to perform administrative actions through the REST API.

ID	Name	Product	Family	Type	Severity
421403	SCA: security update for flowise (GHSA-6wp6-22x5-rr3w)	Tenable Cloud Security	SCA Checks	Local	high
421403	SCA: security update for flowise (GHSA-6wp6-22x5-rr3w)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
114312	Flowise < 1.6.6 Authentication Bypass	Web App Scanning	Artificial Intelligence	Check Based	high

Detections

Analytics

CVE-2024-31621

high

Tenable Plugins

high

high

high