p PatchFirst

CVE-2021-43775

CVE-2021-43775 · Arbitrary file reading vulnerability in Aim

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

CVSS 8.6 · High · EPSS 1.9% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • aim

    Versions
    • < 3.1.0: Affected

    No fix published

  • aim PyPI

    Versions
    • 2.0.19
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.0.6
    • 3.0.7
    Affected ranges
    • ECOSYSTEM: < 3.1.0

    Update to 3.1.0

  • aim PyPI

    Versions
    • 2.0.19
    • 2.0.20
    • 2.0.20rc1
    • 2.0.20rc2
    • 2.0.21
    • 2.0.21rc1
    • 2.0.22
    • 2.0.22rc1
    • 2.0.22rc2
    • 2.0.22rc3
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.0.27rc2
    • 2.0.27rc3
    • 2.0.27rc4
    • 2.0.27rc5
    • 2.1.0
    • 2.1.1
    • 2.1.1rc1
    • 2.1.1rc6
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.5rc1
    • 2.1.6
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.3.0rc1
    • 2.3.0rc2
    • 2.3.0rc3
    • 2.4.0
    • 2.5.0
    • 2.5.0rc1
    • 2.5.0rc2
    • 2.5.0rc3
    • 2.5.0rc4
    • 2.5.0rc5
    • 2.5.0rc6
    • 2.5.0rc7
    • 2.6.0
    • 2.6.0rc1
    • 2.7.0
    • 2.7.0rc1
    • 2.7.1
    • 2.7.1rc1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 2.7.4rc1
    • 3.0.0
    • 3.0.0a1
    • 3.0.0a2
    • 3.0.0a3
    • 3.0.0a4
    • 3.0.0b1
    • 3.0.0b2
    • 3.0.0b3
    • 3.0.0b4
    • 3.0.0b5
    • 3.0.0b6
    • 3.0.0b6.dev1
    • 3.0.0b7
    • 3.0.0b7.dev1
    • 3.0.0b7.dev2
    • 3.0.0b7.dev3
    • 3.0.0b7.dev4
    • 3.0.0rc1
    • 3.0.0rc10
    • 3.0.0rc2
    • 3.0.0rc3
    • 3.0.0rc4
    • 3.0.0rc7
    • 3.0.0rc8
    • 3.0.0rc9
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.0.6
    • 3.0.7
    • 3.1.0rc1
    Affected ranges
    • ECOSYSTEM: < 3.1.0

    Update to 3.1.0

Original sources

Check your server →