CVE-2021-43775

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2021-43775
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-43775.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-43775
Aliases
Published
2021-11-23T21:15:20Z
Modified
2024-05-14T10:59:50.959173Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

References

Affected packages

Git / github.com/aimhubio/aim

Affected ranges

Type
GIT
Repo
https://github.com/aimhubio/aim
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

Other

pre-launch

v0.*

v0.1.0
v0.1.1
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8

v1.*

v1.0.0
v1.0.2
v1.1.0
v1.1.1
v1.2.7rc1

v2.*

v2.1.6
v2.2.0
v2.2.1
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0

v3.*

v3.0.0
v3.0.0-beta5
v3.0.0-beta6
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7