CVE-2024-4890CWE-89

Blind SQL Injection in berriai/litellm

Medium · published June 6, 2024

CVSS v3.0
4.9
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

The record
Technical detail
CVSS v3.0
4.9 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2024-06-06T18:23Z
EPSS history
Timeline
  • 06 JUN 18:23Z
    Blind SQL Injection in berriai/litellm
    cvelistv5