CVE-2024-27318

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada linuxfoundation onnx, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

Rincian

Terbit di NVD

23 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/onnx/onnx/commit/66b7fb630903fdcf3e83b6b6d56d82e904264a20 patch
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHI... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDM... advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479 product