CVE-2024-4888: fallo de gravedad media en berriai/litellm
Arbitrary File Deletion in BerriAI/litellm
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.6%
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Productos afectados
berriai · berriai/litellmCVEs relacionadas — berriai/litellm
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6587HIGHSSRF in berriai/litellmEPSS 34.4%CVE-2024-6825HIGHRemote Code Execution in BerriAI/litellmEPSS 1.7%CVE-2024-2952CRITICALServer-Side Template Injection in BerriAI/litellmEPSS 1.3%CVE-2024-4264CRITICALRemote Code Execution in berriai/litellmEPSS 0.9%CVE-2024-5751CRITICALRemote Code Execution in BerriAI/litellmEPSS 0.9%CVE-2024-4889HIGHCode Injection in berriai/litellmEPSS 0.9%