bentoml openllm up to up to 0.6.10 path traversal

Summaryinfo

A vulnerability marked as problematic has been reported in bentoml openllm up to up to 0.6.10. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in path traversal. This vulnerability is known as CVE-2024-8982. Attacking locally is a requirement. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in bentoml openllm up to up to 0.6.10. This affects an unknown code. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-29. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality. The summary by CVE is:

A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical data. Unauthorized access to critical server files, such as configuration files, user credentials (/etc/passwd), and private keys, can lead to a complete compromise of the system's security. Attackers could leverage the exposed information to further penetrate the network, exfiltrate data, or escalate privileges within the environment.

The advisory is shared at huntr.com. This vulnerability is uniquely identified as CVE-2024-8982 since 09/18/2024. The exploitability is told to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• bentoml

Name

• openllm

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4
• 0.6.5
• 0.6.6
• 0.6.7
• 0.6.8
• 0.6.9
• 0.6.10

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion