CVE-2023-6021

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6021
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8 Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*
History

06 Dec 2023, 21:15

Type Values Removed Values Added
Summary LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

06 Dec 2023, 20:15

Type Values Removed Values Added
Summary LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023 https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

29 Nov 2023, 10:15

Type Values Removed Values Added
Summary LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication.

24 Nov 2023, 23:05

Type Values Removed Values Added
CWE CWE-22
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8 - () https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8 - Exploit
First Time Ray Project
Ray Project ray
CPE cpe:2.3:a:ray_project:ray:-:*:*:*:*:*:*:*

16 Nov 2023, 17:30

Type Values Removed Values Added
New CVE
Information

Published : 2023-11-16 17:15

Updated : 2024-02-28 20:54

NVD link : CVE-2023-6021

Mitre link : CVE-2023-6021

CVE.ORG link : CVE-2023-6021

JSON object : View

Products Affected

ray_project

  • ray
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-29

Path Traversal: '\..\filename'