{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8982",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T17:48:41.991067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T18:21:47.837Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bentoml/openllm",
          "vendor": "bentoml",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical data. Unauthorized access to critical server files, such as configuration files, user credentials (/etc/passwd), and private keys, can lead to a complete compromise of the system\u0027s security. Attackers could leverage the exposed information to further penetrate the network, exfiltrate data, or escalate privileges within the environment."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-29",
              "description": "CWE-29 Path Traversal: \u0027\\..\\filename\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-20T10:10:25.442Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/b7bdc9a1-51ac-402a-8e6e-0d977699aca6"
        }
      ],
      "source": {
        "advisory": "b7bdc9a1-51ac-402a-8e6e-0d977699aca6",
        "discovery": "EXTERNAL"
      },
      "title": "Local File Inclusion in bentoml/openllm"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-8982",
    "datePublished": "2025-03-20T10:10:25.442Z",
    "dateReserved": "2024-09-18T18:18:48.444Z",
    "dateUpdated": "2025-03-20T18:21:47.837Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8982\",\"sourceIdentifier\":\"security@huntr.dev\",\"published\":\"2025-03-20T10:15:45.463\",\"lastModified\":\"2025-03-20T10:15:45.463\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical data. Unauthorized access to critical server files, such as configuration files, user credentials (/etc/passwd), and private keys, can lead to a complete compromise of the system\u0027s security. Attackers could leverage the exposed information to further penetrate the network, exfiltrate data, or escalate privileges within the environment.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de inclusi\u00f3n de archivos locales (LFI) en OpenLLM versi\u00f3n 0.6.10 permite a los atacantes incluir archivos del servidor local a trav\u00e9s de la aplicaci\u00f3n web. Esta falla podr\u00eda exponer archivos internos del servidor e informaci\u00f3n potencialmente confidencial, como archivos de configuraci\u00f3n, contrase\u00f1as y otros datos cr\u00edticos. El acceso no autorizado a archivos cr\u00edticos del servidor, como archivos de configuraci\u00f3n, credenciales de usuario (/etc/passwd) y claves privadas, puede comprometer por completo la seguridad del sistema. Los atacantes podr\u00edan aprovechar la informaci\u00f3n expuesta para penetrar a\u00fan m\u00e1s en la red, extraer datos o escalar privilegios dentro del entorno.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@huntr.dev\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-29\"}]}],\"references\":[{\"url\":\"https://huntr.com/bounties/b7bdc9a1-51ac-402a-8e6e-0d977699aca6\",\"source\":\"security@huntr.dev\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Local File Inclusion in bentoml/openllm\", \"providerMetadata\": {\"orgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"shortName\": \"@huntr_ai\", \"dateUpdated\": \"2025-03-20T10:10:25.442Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This flaw could expose internal server files and potentially sensitive information such as configuration files, passwords, and other critical data. Unauthorized access to critical server files, such as configuration files, user credentials (/etc/passwd), and private keys, can lead to a complete compromise of the system\u0027s security. Attackers could leverage the exposed information to further penetrate the network, exfiltrate data, or escalate privileges within the environment.\"}], \"affected\": [{\"vendor\": \"bentoml\", \"product\": \"bentoml/openllm\", \"versions\": [{\"version\": \"unspecified\", \"status\": \"affected\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"latest\"}]}], \"references\": [{\"url\": \"https://huntr.com/bounties/b7bdc9a1-51ac-402a-8e6e-0d977699aca6\"}], \"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"NONE\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.2, \"baseSeverity\": \"MEDIUM\"}}], \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"lang\": \"en\", \"description\": \"CWE-29 Path Traversal: \u0027\\\\..\\\\filename\u0027\", \"cweId\": \"CWE-29\"}]}], \"source\": {\"advisory\": \"b7bdc9a1-51ac-402a-8e6e-0d977699aca6\", \"discovery\": \"EXTERNAL\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8982\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-20T17:48:41.991067Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-20T17:48:43.300Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-8982\", \"assignerOrgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"@huntr_ai\", \"dateReserved\": \"2024-09-18T18:18:48.444Z\", \"datePublished\": \"2025-03-20T10:10:25.442Z\", \"dateUpdated\": \"2025-03-20T18:21:47.837Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}