Kurz gesagt
- CVE-2024-8769 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in aim, aim (aimstack).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.93%, höher als bei 60.5% aller Schwachstellen.
- Abhilfe: auf 3.24.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| aim PyPI | ≥ 3.15.0, ≤ 3.27.0
| No fix yet |
| aim | < 3.24.0
| 3.24.0
|
Description
A vulnerability in the LockManager.release_locks function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The run_hash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the Repo._close_run() method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
NVD description
A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free