CVE-2023-6020

🗓️ 16 Nov 2023 21:07:33Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 111 Views🌐 WEB

LFI in Ray's /static/ directory allows unauthorized file acces

Reporter	Title	Published	Views	Family All 39
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to an incorrect path name limitation for the restricted access catalog, allows attackers to read arbitrary files.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the dashboard component of the application scaling framework for AI and Python Ray applications, which allows a hacker to execute arbitrary commands.	3 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the AI application scaling framework and Python Ray, related to deficiencies in the authentication process, allows attackers to read arbitrary files from the /static/ directory.	3 Apr 202400:00	–	bdu_fstec
Circl	CVE-2023-6020	25 Nov 202312:14	–	circl
CNNVD	Ray Security breach	16 Nov 202300:00	–	cnnvd
CVE	CVE-2023-6019	16 Nov 202316:12	–	cve
Cvelist	CVE-2023-6020 Ray Static File Local File Include	16 Nov 202321:07	–	cvelist
Github Security Blog	Ray Path Traversal vulnerability	16 Nov 202318:30	–	github
Github Security Blog	Ray Missing Authorization vulnerability	16 Nov 202321:30	–	github
Metasploit	Ray static arbitrary file read	23 Aug 202418:52	–	metasploit

NVD

Node

ray_project rayMatch-

[
  {
    "vendor": "ray-project",
    "product": "ray-project/ray",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/83dd8619-6dc3-4c98-8f1b-e620fedcd1f6

Parameter	Position	Path	Description	CWE
FILEPATH	path	/static/js/../../../../../../../../../../../../../..{FILEPATH}	Local file inclusion via path traversal in Ray static directory (CVE-2023-6020).	CWE-862

17 Jun 2026 06:49Current

7.4High risk

Vulners AI Score7.4

CVSS 3.17.5

CVSS 37.5

EPSS0.14652

CWE-862