CVE-2022-24856

CVE-2022-24856 describes a Server-Side Request Forgery (SSRF) vulnerability in FlyteConsole versions prior to 0.52.0, the web user interface for the Flyte platform. This flaw allows an unauthenticated attacker to exploit any user of an internet-exposed FlyteConsole instance to access internal metadata servers or other unauthenticated URLs, potentially leading to the disclosure of sensitive information. The vulnerability carries a CVSS score of 7.5 (High) due to its network attack vector and low complexity, with a high impact on confidentiality. While there is no evidence of active exploitation or Metasploit modules, a Nuclei template exists, and the vulnerability has a high EPSS score and FAUCET Risk Score, indicating a significant potential for exploitation.