CVE-2024-8019criticalCWE-434

CVE-2024-8019: falha crítica em lightning-ai/pytorch-lightning

Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

Publicada em

Seguir esta CVE+ Monitorar lightning-ai/pytorch-lightning+ Monitorar lightning

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 1.1%
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
lightning-ai · lightning-ai/pytorch-lightning
CVEs relacionadas — lightning-ai/pytorch-lightning

No mesmo produto, das mais perigosas para as menos.

CVE-2024-5452CRITICALRCE via Property/Class Pollution in lightning-ai/pytorch-lightningEPSS 26.8%CVE-2024-5980CRITICALArbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightningEPSS 1.3%CVE-2024-8020HIGHDenial of Service in lightning-ai/pytorch-lightningEPSS 0.6%