Log in Start free

Vulnerability · Published Nov 23, 2021 · Assigned by GitHub_M

CVE-2021-43775Arbitrary file reading vulnerability in Aim

High 8.6

In plain English

A high-severity path traversal in aim from aimhubio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.9%top 20.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIaim3.1.0GHSA-8phj-f9w2-cjcc
PyPIaim3.1.0PYSEC-2021-839

Affected products (as reported)

VendorProductVersions
aimhubio aim < 3.1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References