Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2022-21822: NVIDIA FLARE: Unauthenticated Access to Admin Interface
CVE-2022-21822 · published 4 years ago
Summary
An unauthorized user can access the admin interface, potentially causing the system to become unavailable by consuming all resources. This could lead to downtime and disruption of services. NVIDIA recommends updating to the latest version to fix the issue.
What to do
- Update nvflare to version 2.0.16.
- Update nvidia federated_learning_application_runtime_environment to version 2.0.16 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | – | nvflare |
< 2.0.16 Fix: upgrade to 2.0.16
|
| – | nvidia | federated_learning_application_runtime_environment |
< 2.0.16 cpe:2.3:a:nvidia:federated_learning_application_runtime_environment:*:*:*:*:*:*:*:* |
Original advisory text
NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavaila...
NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
References
- https://github.com/advisories/GHSA-jx8f-cpx7-fv47
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21822... Vendor Advisory
- https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-21822 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published17 Mar 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta