Vulnerabilities > CVE-2022-39383 - Server-Side Request Forgery (SSRF) vulnerability in Linuxfoundation Kubevela

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

linuxfoundation

CWE-918

NVD

Published: 2022-11-16

Updated: 2022-11-18

Summary

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're using v1.6, please update the v1.6.1. Users who're using v1.5, please update the v1.5.8. There are no known workarounds for this issue.

Vulnerable Configurations

Part	Description	Count
Application	Linuxfoundation Linuxfoundation Kubevela 0.0.1 Linuxfoundation Kubevela 0.0.1.1 Linuxfoundation Kubevela 0.0.1.2 Linuxfoundation Kubevela 0.0.2 Linuxfoundation Kubevela 0.0.3 Linuxfoundation Kubevela 0.0.4 Linuxfoundation Kubevela 0.0.5 Linuxfoundation Kubevela 0.0.6 Linuxfoundation Kubevela 0.0.7 Linuxfoundation Kubevela 0.0.8 Linuxfoundation Kubevela 0.0.9 Linuxfoundation Kubevela 0.1.0 Linuxfoundation Kubevela 0.1.1 Linuxfoundation Kubevela 0.1.2 Linuxfoundation Kubevela 0.2.0 Linuxfoundation Kubevela 0.2.1 Linuxfoundation Kubevela 0.2.2 Linuxfoundation Kubevela 0.3.0 Linuxfoundation Kubevela 0.3.1 Linuxfoundation Kubevela 0.3.2 Linuxfoundation Kubevela 0.3.3 Linuxfoundation Kubevela 0.3.4 Linuxfoundation Kubevela 0.3.5 Linuxfoundation Kubevela 0.3.6 Linuxfoundation Kubevela 0.3.7 Linuxfoundation Kubevela 0.3.8 Linuxfoundation Kubevela 0.3.9 Linuxfoundation Kubevela 1.0.0 Linuxfoundation Kubevela 1.0.1 Linuxfoundation Kubevela 1.0.2 Linuxfoundation Kubevela 1.0.3 Linuxfoundation Kubevela 1.0.4 Linuxfoundation Kubevela 1.0.5 Linuxfoundation Kubevela 1.0.6 Linuxfoundation Kubevela 1.0.7 Linuxfoundation Kubevela 1.1.0 Linuxfoundation Kubevela 1.1.1 Linuxfoundation Kubevela 1.1.2 Linuxfoundation Kubevela 1.1.3 Linuxfoundation Kubevela 1.1.4 Linuxfoundation Kubevela 1.1.5 Linuxfoundation Kubevela 1.1.6 Linuxfoundation Kubevela 1.1.7 Linuxfoundation Kubevela 1.1.8 Linuxfoundation Kubevela 1.1.9 Linuxfoundation Kubevela 1.1.10 Linuxfoundation Kubevela 1.1.11 Linuxfoundation Kubevela 1.1.13 Linuxfoundation Kubevela 1.2.0 Linuxfoundation Kubevela 1.2.1 Linuxfoundation Kubevela 1.2.2 Linuxfoundation Kubevela 1.2.3 Linuxfoundation Kubevela 1.2.4 Linuxfoundation Kubevela 1.2.5 Linuxfoundation Kubevela 1.2.6 Linuxfoundation Kubevela 1.2.7 Linuxfoundation Kubevela 1.2.8 Linuxfoundation Kubevela 1.3.0 Linuxfoundation Kubevela 1.3.1 Linuxfoundation Kubevela 1.3.2 Linuxfoundation Kubevela 1.3.3 Linuxfoundation Kubevela 1.3.4 Linuxfoundation Kubevela 1.3.5 Linuxfoundation Kubevela 1.3.6 Linuxfoundation Kubevela 1.3.7 Linuxfoundation Kubevela 1.3.9 Linuxfoundation Kubevela 1.3.10 Linuxfoundation Kubevela 1.4.0 Linuxfoundation Kubevela 1.4.1 Linuxfoundation Kubevela 1.4.2 Linuxfoundation Kubevela 1.4.3 Linuxfoundation Kubevela 1.4.4 Linuxfoundation Kubevela 1.4.5 Linuxfoundation Kubevela 1.4.6 Linuxfoundation Kubevela 1.4.7 Linuxfoundation Kubevela 1.4.8 Linuxfoundation Kubevela 1.4.9 Linuxfoundation Kubevela 1.4.10 Linuxfoundation Kubevela 1.4.11 Linuxfoundation Kubevela 1.4.12 Linuxfoundation Kubevela 1.4.13 Linuxfoundation Kubevela 1.5.0 Linuxfoundation Kubevela 1.5.2 Linuxfoundation Kubevela 1.5.3 Linuxfoundation Kubevela 1.5.4 Linuxfoundation Kubevela 1.5.5 Linuxfoundation Kubevela 1.5.6 Linuxfoundation Kubevela 1.5.7 Linuxfoundation Kubevela 1.5.8 Linuxfoundation Kubevela 1.6.0 Linuxfoundation Kubevela 1.6.1	136

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References