Lucene search
CVE-2024-5980
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution
Show more
| Reporter | Title | Published | Views | Family All 5 |
|---|---|---|---|---|
 | CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning | 27 Jun 202418:46 | – | cvelist |
 | pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint | 27 Jun 202421:32 | – | github |
 | CVE-2024-5980 | 27 Jun 202419:15 | – | nvd |
 | CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning | 27 Jun 202418:46 | – | vulnrichment |
 | GHSA-MR7H-W2QC-FFC2 pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint | 27 Jun 202421:32 | – | osv |
[
{
"vendor": "lightning-ai",
"product": "lightning-ai/pytorch-lightning",
"versions": [
{
"version": "unspecified",
"status": "affected",
"versionType": "custom",
"lessThanOrEqual": "latest"
}
]
}
]| Source | Link |
|---|---|
| huntr | www.huntr.com/bounties/55a6ac6f-89c7-42ea-86f3-c6e93a2679f3 |
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo27 Jun 2024 19:15Current
9.5High risk
Vulners AI Score9.5
CVSS39.1
EPSS0.00724
SSVC