CVE-2023-6021

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-6021
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6021.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6021
Aliases
Published
2023-11-16T16:11:42Z
Modified
2026-10-24T10:30:37Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Ray Log File Local File Include
Details

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Database specific 
{
    "cna_assigner":  "@huntr_ai",
    "cwe_ids":  [
        "CWE-29"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6021.json"
}
References

Affected packages

Git / github.com/ray-project/ray

Affected ranges

Type
GIT
Repo
https://github.com/ray-project/ray
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3546c41b9996c36d0f1bba497dc660d3fcfc59a7
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.8.1+"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Affected versions

ray-0.*
ray-0.1.0
ray-0.1.1
ray-0.1.2
ray-0.2.0
ray-0.2.1
ray-0.2.2
ray-0.3.0
ray-0.3.1
ray-0.4.0
ray-0.5.0
ray-0.5.1
ray-0.5.2
ray-0.5.3
ray-0.6.0
ray-0.6.1
ray-0.6.2
ray-0.6.3
ray-0.6.4
ray-0.6.5
ray-0.7.0
ray-2.*
ray-2.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6021.json"