CVE-2023-6021

Ray Log File Local File Include

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Affected

ray-project · ray-project/ray

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.0 GitHub

9.3 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

EPSS

37.08% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high

Published

2023-11-16

Updated

2024-11-27

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6021.yaml

Security advisories

• advisories/GHSA-3pww-qvr8-6mhp

References

• CVE Record
• NVD entry