Kubeflow
CVE-2023-6570
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow
AnalysisAI
Server-Side Request Forgery (SSRF) in kubeflow/kubeflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. Affected products include: Kubeflow.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.
kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to inefficient regular expr
Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow. Rated medium severity (CVSS 6.1), this vulnerability is rem
Server-side request forgery in the Kubeflow Pipelines frontend server (prior to 2.17.0) lets any unauthenticated network
Authorization token theft in Kubeflow Community Distribution before 26.03-rc.1 lets a low-privileged tenant hijack other
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. Rated high severity (CVSS 7.1), this vulnerabi
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today