Home > Vulnerability Database > CVE-2023-6019

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2023-6019

Good to know:

Date: November 16, 2023

A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Language: Python

Severity Score

9.8

Related Resources (6)

Url: https://github.com/ray-project/ray

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-6019

Url: https://github.com/ray-project/ray/releases/tag/ray-2.8.1

Url: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Url: https://huntr.com/bounties/d0290f3c-b302-4161-89f2-c13bb28b4cfe

Url: https://www.mend.io/vulnerability-database/CVE-2023-6019

Severity Score

9.8

Weakness Type (CWE)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78

Top Fix

Upgrade Version

Upgrade to version ray - 2.8.1

CVSS v3.1

Base Score:	9.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us