Arbitrary file reading vulnerability in Aim

🗓️ 23 Nov 2021 22:03:23Reported by GitHub Advisory DatabaseType

Arbitrary file reading vulnerability in Aim. Path traversal attack aims to access files outside the web root folder by manipulating file references. Vulnerable code: github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16. Resolved in Aim v3.1.

Reporter	Title	Published	Views	Family All 13
CNNVD	Aim 路径遍历漏洞	23 Nov 202100:00	–	cnnvd
CNVD	Aim path traversal vulnerability	25 Nov 202100:00	–	cnvd
CVE	CVE-2021-43775	23 Nov 202119:15	–	cve
Cvelist	CVE-2021-43775 Arbitrary file reading vulnerability in Aim	23 Nov 202119:15	–	cvelist
EUVD	EUVD-2021-0002	7 Oct 202500:30	–	euvd
NVD	CVE-2021-43775	23 Nov 202121:15	–	nvd
OSV	GHSA-8PHJ-F9W2-CJCC Arbitrary file reading vulnerability in Aim	23 Nov 202122:03	–	osv
OSV	PYSEC-2021-839	23 Nov 202121:15	–	osv
Prion	Path traversal	23 Nov 202121:15	–	prion
Positive Technologies	PT-2021-23924 · Aim · Aim	23 Nov 202100:00	–	ptsecurity

Vulners

Node

aim_sniff aim_sniffRange<3.1.0pip

Source	Link
github	www.github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc
github	www.github.com/aimhubio/aim/pull/1003
github	www.github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-43775
github	www.github.com/aimhubio/aim/issues/999
github	www.github.com/aimhubio/aim/commit/b9e53df5e32d14bbd3a2c738e2db7187fb531e93
github	www.github.com/pypa/advisory-database/tree/main/vulns/aim/PYSEC-2021-839.yaml
github	www.github.com/advisories/GHSA-8phj-f9w2-cjcc

18 Nov 2024 16:26Current

1Low risk

Vulners AI Score1

CVSS 25

CVSS 3.18.6

EPSS0.00447

CWE-22