Home > Vulnerability Database > CVE-2024-9148

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2024-9148

Good to know:

Date: September 24, 2024

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.

Language: JS

Severity Score

9.6

Related Resources (8)

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-9148

Url: https://www.tenable.com/security/research/tra-2024-40

Url: https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.1.1

Url: https://github.com/FlowiseAI/FlowiseChatEmbed

Url: https://github.com/FlowiseAI/Flowise/commit/8375ebb4ec1ebb2b1295561cc0f63486a29f3fde

Url: https://github.com/FlowiseAI/FlowiseChatEmbed/commit/6a9645df41371cb69f251038d501ec87b1304c84

Url: https://github.com/FlowiseAI/FlowiseChatEmbed/releases/tag/flowise-embed%402.0.0

Url: https://www.mend.io/vulnerability-database/CVE-2024-9148

Severity Score

9.6

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

Top Fix

Upgrade Version

Upgrade to version flowise-embed - 2.0.0;flowise - 2.1.1

CVSS v3.1

Base Score:	9.6
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us