Vulnerability · Published Aug 27, 2024 · Assigned by tenable
CVE-2024-8182Flowise Denial of Service
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Flowise from FlowiseAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 13.9% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)13.9%top 3.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | flowise | no fix listed | GHSA-48x4-mx8f-gr4h |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H