References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Known Affected Software Configurations Switch to CPE 2.2

Change History

OR
          *cpe:2.3:a:langgenius:dify:*:*:*:*:*:node.js:*:* versions up to (excluding) 0.6.12

GitHub, Inc.: https://github.com/langgenius/dify/pull/5266 Types: Issue Tracking, Patch

GitHub, Inc.: https://github.com/langgenius/dify/security/advisories/GHSA-6pw4-jqhv-3626 Types: Exploit, Vendor Advisory

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access and changes on the APPSs. This issue has been patched in version 0.6.12. A workaround for this vulnerability involves updating the the access control mechanisms to enforce stricter user role permissions and implementing role-based access controls (RBAC) to ensure that only users with admin privileges can access Orchestration of the APPs.

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

CWE-284

CWE-862

https://github.com/langgenius/dify/pull/5266

https://github.com/langgenius/dify/security/advisories/GHSA-6pw4-jqhv-3626