orchest

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

orchest records in CISA KEV

No orchest vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

2 records

TI-2022-13428 CVE-2022-31503

MEDIUM 43

The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.01567 Published 2022-07-11 No fix listed CWE-22

TI-2022-18644 CVE-2022-39268

LOW 38

### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00516 Published 2022-09-30 No fix listed CWE-352