CVE-2024-8183: 
Python vulnerability analysis and mitigation

A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data (NVD, CVE Mitre). The vulnerability was discovered and disclosed in March 2024, affecting the Prefect workflow automation platform.

The vulnerability stems from a CORS misconfiguration that allows unauthorized domains to make cross-origin requests to the API. The issue has been assigned a CVSS v3.0 base score of 7.6 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L. The vulnerability is classified as CWE-346 (Origin Validation Error) (NVD).

The vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks (NVD).

The vulnerability can be exploited remotely by making cross-origin requests to the affected API endpoints. The attack complexity is low, requiring no privileges but does need user interaction (NVD).

A fix has been implemented that adds settings to control server CORS configuration. The patch introduces three new settings: PREFECT_SERVER_CORS_ALLOWED_ORIGINS, PREFECT_SERVER_CORS_ALLOWED_METHODS, and PREFECT_SERVER_CORS_ALLOWED_HEADERS, allowing administrators to explicitly specify authorized origins, methods, and headers for cross-origin requests (Github Commit).