CVE-2023-6021 — Ray Log File Local File Include

CVE-2023-6021

Ray Log File Local File Include PUBLISHED

Description (CNA)

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Affected (CNA)

Vendor / product	Versions
ray-project / ray-project/ray	affected unspecified through latest

CWE

CWE-29

References

https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8

ADP enrichment

CVE

No English description supplied.

https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8

CISA-ADP

No English description supplied.

No references supplied.