p PatchFirst

CVE-2024-6483

CVE-2024-6483 · Arbitrary File/Directory Deletion in aimhubio/aim

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A vulnerability in the `runs/delete-batch` endpoint of aimhubio/aim version 3.19.3 allows for arbitrary file or directory deletion through path traversal. The endpoint does not mitigate path traversal when handling user-specified run-names, which are used to specify log/metadata files for deletion. This can be exploited to delete arbitrary files or directories, potentially causing denial of service or data loss.

CVSS 5.3 · Medium · EPSS 0.9%

Published
Updated

Stack: python

Affected products and versions

  • aimhubio/aim

    Versions
    • ≥ unspecified, ≤ latest: Affected (custom)

    No fix published

  • aim PyPI

    Versions
    • 2.0.19
    • 2.0.20
    • 2.0.21
    • 2.0.22
    • 2.0.23
    • 2.0.24
    • 2.0.25
    • 2.0.26
    • 2.0.27
    • 2.1.0
    • 2.1.1
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.4.0
    • 2.5.0
    • 2.6.0
    • 2.7.0
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.7.4
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 3.0.5
    • 3.0.6
    • 3.0.7
    • 3.1.0
    • 3.1.1
    • 3.10.0
    • 3.10.0.dev9
    • 3.10.1
    • 3.10.2
    • 3.10.3
    • 3.11.0
    • 3.11.0.dev4
    • 3.11.1
    • 3.11.1.dev1
    • 3.11.2
    • 3.12.0
    • 3.12.0.dev2
    • 3.12.1
    • 3.12.2
    • 3.13.0
    • 3.13.1
    • 3.13.2
    • 3.13.3
    • 3.13.4
    • 3.14.0
    • 3.14.1
    • 3.14.2
    • 3.14.3
    • 3.14.4
    • 3.15.0
    • 3.15.1
    • 3.15.2
    • 3.16.0
    • 3.16.1
    • 3.16.2
    • 3.17.0
    • 3.17.1
    • 3.17.2
    • 3.17.3
    • 3.17.4
    • 3.17.5
    • 3.17.5rc1
    • 3.17.5rc2
    • 3.17.5rc3
    • 3.17.5rc4
    • 3.18.0
    • 3.18.0.dev2
    • 3.18.0.dev3
    • 3.18.0.dev4
    • 3.18.0.dev5
    • 3.18.1
    • 3.19.0
    • 3.19.1
    • 3.19.2
    • 3.19.3
    • 3.2.0
    • 3.2.1
    • 3.2.2
    • 3.3.0
    • 3.3.1
    • 3.3.2
    • 3.3.3
    • 3.3.4
    • 3.3.5
    • 3.4.0
    • 3.4.1
    • 3.5.0
    • 3.5.1
    • 3.5.2
    • 3.5.3
    • 3.5.4
    • 3.6.0
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    • 3.7.4
    • 3.7.5
    • 3.8.0
    • 3.8.1
    • 3.9.0a1
    • 3.9.0a14
    • 3.9.2
    • 3.9.3
    • 3.9.4
    Affected ranges
    • ECOSYSTEM: ≤ 3.19.3

    No fix published

Original sources

Check your server →