Skip to content
fr Sign in
7.5 High

CVE-2023-6021 LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication

Description

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Affected products and versions

Product Affected versions Fixed in
ray-project/ray Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of ray-project/ray

The 3 CVEs of ray-project/ray →
CVE-2023-6020 LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication 7.5 High CVE-2023-6019 A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system… 9.8 Critical
Track this CVE