9.1
Critical
CVE-2024-8019 In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a…
Description
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| lightning-ai/pytorch-lightning 2.3 | earliest → < 2.3.3 | 2.3.3 |
References
- huntr.com huntr.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of lightning-ai/pytorch-lightning
The 4 CVEs of lightning-ai/pytorch-lightning →
CVE-2024-8020
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by…
7.5
High
CVE-2024-5980
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path…
9.1
Critical
CVE-2024-5452
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to…
9.8
Critical