Approved changes feed: RSS · Atom
cpe:2.3:a:orchest:orchest:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Orchest (e466ad2b-ef1a-5739-9734-32d39088b022) |
|---|---|
| Product | Orchest (9247152b-c46a-57d7-91a8-98b4ee491a25) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/orchest/orchest |
purl2cpe | 2026-06-01 10:18:10.876963 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-39268 |
vulnerable | 2026-06-08 05:47:18.471221 |
orchest vulnerable to cross-site request forgery that allows control of a user instance
HIGH (8.1)
### Impact In a CSRF attack, an innocent end user is tricked by an attacker into submitting a web request that they did not intend. This may cause actions to be performed on the website that can include inadvertent client or server data leakage, change of session state, or manipulation of an end user's account. ### Patch Upgrade to v2022.09.10 to patch this vulnerability. ### Workarounds Rebuild and redeploy the Orchest `auth-server` with this commit: https://github.com/orchest/orchest/commit/c2587a963cca742c4a2503bce4cfb4161bf64c2d ### References https://en.wikipedia.org/wiki/Cross-site_request_forgery https://cwe.mitre.org/data/definitions/352.html ### For more information If you have any questions or comments about this advisory: * Open an issue in https://github.com/orchest/orchest * Email us at rick@orchest.io
Published: 2022-09-30T20:25:10.000Z
Updated: 2025-04-23T16:53:18.634Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-31503 |
vulnerable | 2026-06-08 05:43:40.982542 |
Details available
The orchest/orchest repository before 2022.05.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Published: 2022-07-11T00:53:45.000Z
Updated: 2024-08-03T07:19:06.074Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.