CVE-2023-6021
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
- Affected products
- Ray
- Ray Project Ray
- All versions
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 83.9% (100th percentile)
- Weakness
- CWE-22, CWE-29
- NVD status
- Modified
- Published
- 2023-11-16
CVE-2023-6021 at NVD
No indexed exploits for CVE-2023-6021 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2023-6021 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.