Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2024-55459

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar file through the get_file function.

VectorNETWORK

PublishedJan 08, 2025, 17:15

Published Bycve@mitre.org

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

keras(PyPI)0N/AN/A

References

https://github.com/keras-team/keras
https://keras.io
https://river-bicycle-f1e.notion.site/Arbitrary-File-Write-Vulnerability-in-get_file-function-11888e31952580179224e50892976d32

Weakness Type

CWE-494

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK