CVE-2024-5187

🗓️ 06 Jun 2024 18:45:19Reported by @huntr_aiType

A vulnerability in onnx framework 1.16.0 allows arbitrary file overwrite via download_model_with_test_data function, leading to potential remote code execution and system integrity impact

Reporter	Title	Published	Views	Family All 33
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Open Neural Network Exchange (ONNX) affects IBM watsonx Assistant for IBM Cloud Pak for Data	5 Feb 202520:06	–	ibm
Tenable Nessus	Azure Linux 3.0 Security Update: pytorch (CVE-2024-5187)	22 Jan 202600:00	–	nessus
Tenable Nessus	Fedora 40 : onnx (2024-d9c7181a19)	11 Jul 202400:00	–	nessus
Tenable Nessus	Ubuntu 24.04 LTS : ONNX vulnerability (USN-8307-1)	27 May 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2024-5187	6 Mar 202500:00	–	nessus
CBLMariner	CVE-2024-5187 affecting package pytorch for versions less than 2.2.2-3	13 Nov 202420:12	–	cbl_mariner
CNNVD	Open Neural Network Exchange Path Traversal Vulnerability	6 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-5187 Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx	6 Jun 202418:45	–	cvelist
Debian CVE	CVE-2024-5187	6 Jun 202418:45	–	debiancve

NVD

Vulnrichment

Node

linuxfoundation onnxMatch1.16.0

[
  {
    "vendor": "onnx",
    "product": "onnx/onnx",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237e

21 Nov 2024 09:47Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

CVSS 38.8

EPSS0.0261

SSVC

CWE-22