Detections
Analytics

SCA: security update for flowise (GHSA-wxm4-9f8p-gggv)

medium Tenable Self-Hosted Container Security Plugin ID 446628

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3
 of Flowise, a reflected cross-site scripting vulnerability occurs in the `/api/v1/credentials/id`
 endpoint. If the default configuration is used (unauthenticated), an attacker may be able to craft a
 specially crafted URL that injects Javascript into the user sessions, allowing the attacker to steal
 information, create false popups, or even redirect the user to other websites without interaction. If the
 chatflow ID is not found, its value is reflected in the 404 page, which has type text/html. This allows an
 attacker to attach arbitrary scripts to the page, allowing an attacker to steal sensitive information.
 This XSS may be chained with the path injection to allow an attacker without direct access to Flowise to
 read arbitrary files from the Flowise server. As of time of publication, no known patches are available.
 (CVE-2024-37146)

Solution

There is no known solution at this time.

See Also

https://github.com/advisories/GHSA-wxm4-9f8p-gggv

Plugin Details

Severity: Medium

ID: 446628

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/31/2026

Updated: 8/31/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-37146

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.3

Threat Score: 2.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/5/2024

Vulnerability Publication Date: 7/1/2024

Reference Information

CVE: CVE-2024-37146

cwe: CWE-79