{"history":[{"alert":0,"cve":"CVE-2023-6570","id":22622,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00605, \"percentile\": 0.49475}"},{"alert":0,"cve":"CVE-2023-6570","id":20241,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00605, \"percentile\": 0.49309}"},{"alert":0,"cve":"CVE-2023-6570","id":18942,"kind":"epss","observed_at":1794306001,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.00605, \"percentile\": 0.49256}"},{"alert":1,"cve":"CVE-2023-6570","id":18934,"kind":"cna","observed_at":1794306001,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-02T08:35:14.402Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_transferred\"], \"url\": \"https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a\"}], \"title\": \"CVE Program Container\"}], \"cna\": {\"affected\": [{\"product\": \"kubeflow/kubeflow\", \"vendor\": \"kubeflow\", \"versions\": [{\"lessThanOrEqual\": \"latest\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow\"}], \"metrics\": [{\"cvssV3_0\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 7.7, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"scope\": \"CHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"version\": \"3.0\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-918\", \"description\": \"CWE-918 Server-Side Request Forgery (SSRF)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2023-12-14T12:59:57.426Z\", \"orgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"shortName\": \"@huntr_ai\"}, \"references\": [{\"url\": \"https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a\"}], \"source\": {\"advisory\": \"82d6e853-013b-4029-a23f-8b50ec56602a\", \"discovery\": \"EXTERNAL\"}, \"title\": \"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow\"}}, \"cveMetadata\": {\"assignerOrgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"assignerShortName\": \"@huntr_ai\", \"cveId\": \"CVE-2023-6570\", \"datePublished\": \"2023-12-14T12:59:57.426Z\", \"dateReserved\": \"2023-12-07T09:38:52.777Z\", \"dateUpdated\": \"2024-08-02T08:35:14.402Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"}],"record":{"affected":[{"product":"kubeflow/kubeflow","vendor":"kubeflow","versions":[{"lessThanOrEqual":"latest","status":"affected","version":"unspecified","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-02T08:35:14.402Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"kubeflow/kubeflow","vendor":"kubeflow","versions":[{"lessThanOrEqual":"latest","status":"affected","version":"unspecified","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow"}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-918","description":"CWE-918 Server-Side Request Forgery (SSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2023-12-14T12:59:57.426Z","orgId":"c09c270a-b464-47c1-9133-acb35b22c19a","shortName":"@huntr_ai"},"references":[{"url":"https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a"}],"source":{"advisory":"82d6e853-013b-4029-a23f-8b50ec56602a","discovery":"EXTERNAL"},"title":"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow"}},"cveMetadata":{"assignerOrgId":"c09c270a-b464-47c1-9133-acb35b22c19a","assignerShortName":"@huntr_ai","cveId":"CVE-2023-6570","datePublished":"2023-12-14T12:59:57.426Z","dateReserved":"2023-12-07T09:38:52.777Z","dateUpdated":"2024-08-02T08:35:14.402Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1794435601,"cve":"CVE-2023-6570","description":"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow","epss":{"date":"2026-11-12","epss":0.00605,"percentile":0.49475},"epss_checked":1794522003,"first_seen":1794290405,"kev":null,"kev_checked":1794522003,"products":"kubeflow kubeflow/kubeflow","references":["https://huntr.com/bounties/82d6e853-013b-4029-a23f-8b50ec56602a"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","provider":"@huntr_ai","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.0"},"solutions":"","state":"PUBLISHED","title":"Server-Side Request Forgery (SSRF) in kubeflow/kubeflow","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://github.com/advisories/GHSA-f7vj-6669-qvv4","id":256,"publisher":"GitHub Advisory Database","title":"Kubeflow Pipelines \u2014 API server fetches a caller-supplied pipelineURL without host validation"},{"canonical_url":"https://github.com/advisories/GHSA-rjr3-43j3-4q8g","id":263,"publisher":"GitHub Advisory Database","title":"Kubeflow Pipelines API server lacks authorization for shared pipeline uploads"}]}