CVE-2023-29010

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 (07 March 2023) are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action. Self-host users who run Budibase on the public internet and are using a cloud provider that allows HTTP access to metadata information should ensure that when they deploy Budibase live, their internal metadata endpoint is not exposed.

• CWE-918

• https://github.com/Budibase/budibase/commits/develop?after=93d6939466aec192043d8ac842e754f65fdf2e8a+594&branch=develop&qualified_name=refs%2Fheads%2FdevelopPatch
• https://github.com/Budibase/budibase/releases/tag/v2.4.3Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-9xg2-9mcv-985pVendor Advisory
• https://github.com/Budibase/budibase/commits/develop?after=93d6939466aec192043d8ac842e754f65fdf2e8a+594&branch=develop&qualified_name=refs%2Fheads%2FdevelopPatch
• https://github.com/Budibase/budibase/releases/tag/v2.4.3Release Notes
• https://github.com/Budibase/budibase/security/advisories/GHSA-9xg2-9mcv-985pVendor Advisory

Published

Apr 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-29005Flask-AppBuilder versions before 4.3.0 lack rate limiting wh…7.5
• CVE-2023-29006The Order GLPI plugin allows users to manage order managemen…8.8
• CVE-2023-29007Git is a revision control system. Prior to versions 2.30.9, …7.8
• CVE-2023-29008The SvelteKit framework offers developers an option to creat…8.8
• CVE-2023-29009baserCMS is a website development framework with WebAPI that…6.1
• CVE-2023-2901A vulnerability was found in NFine Rapid Development Platfor…6.5
• CVE-2023-29011Git for Windows, the Windows port of Git, ships with an exec…7.8
• CVE-2023-29012Git for Windows is the Windows port of Git. Prior to version…7.8
• CVE-2023-29013Traefik (pronounced traffic) is a modern HTTP reverse proxy …7.5
• CVE-2023-29014The Goobi viewer is a web application that allows digitised …6.1
• CVE-2023-29015The Goobi viewer is a web application that allows digitised …6.1
• CVE-2023-29016The Goobi viewer is a web application that allows digitised …6.1