CVE-2023-6021CWE-29

Ray Log File Local File Include

High · published November 16, 2023

CVSS v3.1

7.5

EPSS

37%

Percentile

98.5

In the wild

Unconfirmed

What it is

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.37076 · 98.5th percentile
Weakness: CWE-29 · Path Traversal: '\..\filename'
Published: 2023-11-16T16:11Z

EPSS history

Timeline

16 NOV 16:11Z
Ray Log File Local File Include
cvelistv5