9.1
Critique
CVE-2024-8019 In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a…
Description
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| lightning-ai/pytorch-lightning 2.3 | premières → < 2.3.3 | 2.3.3 |
Autres CVE de lightning-ai/pytorch-lightning
Les 4 CVE de lightning-ai/pytorch-lightning →
CVE-2024-8020
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by…
7.5
Élevée
CVE-2024-5980
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path…
9.1
Critique
CVE-2024-5452
A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to…
9.8
Critique