| id: GO-2023-2162 |
| modules: |
| - module: github.com/flyteorg/flyteadmin |
| versions: |
| - fixed: 1.1.124 |
| vulnerable_at: 1.1.123 |
| packages: |
| - package: github.com/flyteorg/flyteadmin/pkg/common |
| symbols: |
| - NewSortParameter |
| summary: SQL Injection in List Endpoints in github.com/flyteorg/flyteadmin |
| description: |- |
| A malicious user can send a REST request to a List endpoint with filters that |
| contain custom SQL statements. This can result in SQL injection. |
| cves: |
| - CVE-2023-41891 |
| ghsas: |
| - GHSA-r847-6w6h-r8g4 |
| credits: |
| - '@Sanjana-Sarda' |
| references: |
| - fix: https://github.com/flyteorg/flyteadmin/commit/b3177ef70f068e908140b8a4a9913dfa74f289fd |
| review_status: REVIEWED |
