Description (CNA)
Flowise before 3.0.13 uses bcrypt with default salt rounds of 5, providing only 32 iterations instead of the OWASP-recommended minimum of 10 rounds. Attackers can crack password hashes approximately 30 times faster with modern GPU hardware, potentially compromising all user accounts in a database breach scenario.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Flowise / Flowise | affected 0 before 3.0.13; unaffected 3.0.13 |
CWE
CWE-916
References
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-x2g5-fvc2-gqvp
- https://www.vulncheck.com/advisories/flowise-insufficient-password-salt-rounds-in-bcrypt-hashing
ADP enrichment
No English description supplied.
No references supplied.