CVE-2023-48022

Katalog CVE

CVSS 9.8 · Critical EPSS 83,9%

Kerentanan Server-Side Request Forgery (SSRF) pada anyscale ray. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment. (Also, within that environment, customers at version 2.52.0 and later can choose to use token authentication.)

Rincian

Terbit di NVD

28 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

83,9% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0 exploit · advisory pihak ketiga
• https://atlas.mitre.org/studies/AML.CS0023
• https://docs.ray.io/en/latest/ray-security/index.html product · release notes
• https://docs.ray.io/en/latest/ray-security/token-auth.html
• https://www.vicarius.io/vsociety/posts/shadowray-cve-2023-48022-exploit
• https://www.vicarius.io/vsociety/posts/the-story-of-shadowray-cve-2023-48022