Is CVE-2024-8182 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-8182 being exploited in the wild.

How severe is CVE-2024-8182?

Low severity, with a CVSS score of 3.1, published 27 August 2024.

Which products and versions are affected?

flowise (npm) SEMVER:introduced=0,last_affected=1.8.2.

Is there a fix for CVE-2024-8182?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-8182 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2024-8182?

Check whether you run flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-8182: Flowise unauthenticated denial of service in file upload endpoint

CVE-2024-8182 · Severity: low · CVSS 3.1 · Published 2024-08-27

Flowise is a visual AI agent builder used to create and deploy intelligent automation workflows. An unauthenticated attacker can crash the entire Flowise instance by sending a specially crafted request to the file upload API endpoint, rendering the service unavailable to all users and disrupting business operations that depend on the platform.

Technologies: flowise (npm). Vendors: npm.

Quick answers

Is CVE-2024-8182 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-8182 being exploited in the wild.
How severe is CVE-2024-8182?: Low severity, with a CVSS score of 3.1, published 27 August 2024.
Which products and versions are affected?: flowise (npm) SEMVER:introduced=0,last_affected=1.8.2.
Is there a fix for CVE-2024-8182?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-8182 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2024-8182?: Check whether you run flowise (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated denial of service vulnerability exists in Flowise version 1.8.2 in the /api/v1/get-upload-file endpoint due to improper handling of user-supplied input. The vulnerability is classified as CWE-400 (uncontrolled resource consumption). An attacker can send a crafted request to this endpoint without authentication to trigger a complete crash of the Flowise instance. The attack vector is network-based with no authentication required and no user interaction needed. As of the disclosure date (August 27, 2024), Flowise maintainers had not provided a patch or mitigation strategy despite multiple contact attempts from Tenable beginning in June 2024. The repository has since been archived.

Affected products

Flowise Flowise 1.8.2 and all previous versions

Identifiers

CVE-2024-8182
GHSA-48x4-mx8f-gr4h

Timeline

2024-08-27: disclosed: Vulnerability published by Tenable; CVE-2024-8182 assigned
2024-06-13: other: Tenable first contacted vendor for security contact
2024-08-14: other: Tenable third contact attempt with vendor

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.