CVE-2021-43775

Katalog CVE

CVSS 8.6 · High EPSS 1,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada aimstack aim. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Aim is an open-source, self-hosted machine learning experiment tracking tool. Versions of Aim prior to 3.1.0 are vulnerable to a path traversal attack. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files. The vulnerability issue is resolved in Aim v3.1.0.

Rincian

Terbit di NVD

23 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,9% peluang dieksploitasi; lebih tinggi dari 79,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aimhubio/aim/pull/1003 patch · advisory pihak ketiga
• https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738 patch
• https://github.com/aimhubio/aim/issues/999 issue tracking · advisory pihak ketiga
• https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc exploit · advisory pihak ketiga
• https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16 product