Lucene search

JFROGCVELIST:CVE-2024-6507

HistoryJul 04, 2024 - 11:58 a.m.

CVE-2024-6507 Deep Lake Kaggle command injection

2024-07-0411:58:21

JFROG

www.cve.org

cve-2024-6507

deep lake kaggle

input sanitization

ingest_kaggle api

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.1%

JSON

Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest_kaggle() API

CNA Affected

[
  {
    "collectionURL": "https://pypi.org/project/pip",
    "packageName": "deeplake",
    "versions": [
      {
        "lessThanOrEqual": "3.9.10",
        "status": "affected",
        "version": "0",
        "versionType": "python"
      }
    ]
  }
]

References

github.com/activeloopai/deeplake/pull/2876

research.jfrog.com/vulnerabilities/deeplake-kaggle-command-injection-jfsa-2024-001035320/

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.1%

JSON

Related for CVELIST:CVE-2024-6507