CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability exists in the Evaluations Endpoint of FlowiseAI versions up to 3.0.2, specifically in the axios.post function. This flaw can be exploited remotely, potentially allowing attackers to manipulate server requests. Organizations using unsupported versions of FlowiseAI should prioritize upgrading to version 3.1.3 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.1.3 is able to resolve this issue. The patch is identified as 700137738bcaebefd4709021f6d6b0abcd7df0ac. It is recommended to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer.
Related CVEs
Other vulnerabilities affecting the same vendor(s)