Vulnerability · Published Oct 25, 2024 · Assigned by VulDB

CVE-2024-10372chidiwilliams buzz model_loader.py download_model temp file

Medium 4.5

In plain English

A medium-severity security flaw in buzz from chidiwilliams. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)4.5Medium

Exploit odds (30 days)0.3%top 79.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function download_model of the file buzz/model_loader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
chidiwilliams	buzz	1.1.0

Weakness: CWE-377 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-281764 | chidiwilliams buzz model_loader.py download_model temp file vdb-entry, technical-description
VDB-281764 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #425441 | Github buzz 1.1.0 Insecure Temporary File in chidiwilliams / buzz third-party-advisory
https://github.com/Startr4ck/CVE_lists/blob/main/buzz/Insecure%20Temporary%20File%20in%20BUZZ.md exploit