CVE-2023-29010
Medium
Description
Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information should ensure that when they deploy Budibase live, their internal metadata endpoint is not exposed.
SeverityMedium
CVSS6.5
Exploit probability—
ProductBudibase
PublishedApr 6, 2023
First seenApr 6, 2023
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- budibase budibase2.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| budibase budibase | v < 2.4.3 | 2.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.