~ / search / GHSA-4hh5-2678-83fx

GHSA-4hh5-2678-83fx

Cross-Site Request Forgery vulnerability in Prefect

Source: GitHub Advisory Database (reviewed) High CVE-2023-6022

Packages

EcosystemPackageAffectedFixed in
PyPI prefect >= 2.0.0, < 2.16.5 2.16.5

Details

As written in the advisory (Markdown source, shown as plain text).

An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.

References

External links from the advisory. They lead to third-party sites.