CVE-2024-4890

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-4890

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4890.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-4890

Aliases

Published

2024-06-06T18:23:49.593Z

Modified

2026-07-15T01:49:21.204579927Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Blind SQL Injection in berriai/litellm

Details

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'userid' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4890.json"
}

References

Affected packages

Git / github.com/berriai/litellm

Affected ranges

Type

GIT

Repo

https://github.com/berriai/litellm

Events

Introduced

0591b4b846513754370896c06943092a3c63ecc9

Last affected

0591b4b846513754370896c06943092a3c63ecc9

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:litellm:litellm:1.27.14:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.27.14"
        },
        {
            "last_affected": "1.27.14"
        }
    ]
}

Affected versions

1.*

1.27.14

v1.*

v1.27.14

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4890.json"