Base Score

HIGH7.5

CVE-2023-6020

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.

VectorNETWORK

Published Bysecurity@huntr.dev

Published DateNov 16, 2023, 21:15

Affected Versions(1)

ray(PyPI)

Introduced0

Fixed2.8.1

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
ray(PyPI)	0	2.8.1	N/A

Weakness Type (CWE):CWE-862

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

NONE

Availability (A)

NONE

References

https://huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6

Base Score

HIGH7.5

Weakness Type (CWE):CWE-862

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

NONE

Availability (A)

NONE