FKIE_CVE-2024-6577

Vulnerability from fkie_nvd - Published: 2025-03-20 10:15 - Updated: 2025-03-20 10:15
Severity ?
6.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Summary
In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data.
References
security@huntr.devhttps://huntr.com/bounties/20917570-8328-428f-bd1d-4fcd71fb2359
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the latest version of pytorch/serve, the script \u0027upload_results_to_s3.sh\u0027 references the S3 bucket \u0027benchmarkai-metrics-prod\u0027 without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data."
    },
    {
      "lang": "es",
      "value": "En la \u00faltima versi\u00f3n de pytorch/serve, el script \u0027upload_results_to_s3.sh\u0027 hace referencia al bucket de S3 \u0027benchmarkai-metrics-prod\u0027 sin garantizar su propiedad ni confirmar su accesibilidad. Esto podr\u00eda generar vulnerabilidades de seguridad o acceso no autorizado al bucket si no est\u00e1 protegido correctamente o no es reclamado por la entidad correspondiente. El problema puede provocar filtraciones de datos, exposici\u00f3n de informaci\u00f3n confidencial o modificaciones no autorizadas de los datos almacenados."
    }
  ],
  "id": "CVE-2024-6577",
  "lastModified": "2025-03-20T10:15:32.987",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-20T10:15:32.987",
  "references": [
    {
      "source": "security@huntr.dev",
      "url": "https://huntr.com/bounties/20917570-8328-428f-bd1d-4fcd71fb2359"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-840"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.