CVE-2021-43775CWE-22

Arbitrary file reading vulnerability in Aim

High · published November 23, 2021

CVSS v3.1
8.6
EPSS
2%
Percentile
79.6
In the wild
Unconfirmed
What it is

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01907 · 79.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-11-23T19:15Z
EPSS history
Timeline
  • 23 NOV 19:15Z
    Arbitrary file reading vulnerability in Aim
    cvelistv5