HIGH 8.8 PyPI
Cross-Site Request Forgery vulnerability in Prefect
GHSA-4hh5-2678-83fx · CVE-2023-6022 · PYSEC-2026-1799
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-6022
- WEB https://github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3
- WEB https://github.com/PrefectHQ/prefect/blob/main/RELEASE-NOTES.md#release-2165
- PACKAGE https://github.com/prefecthq/prefect
- WEB https://huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af
Ready to move
Start Securing
Free, no credit card | First findings in minutes