CVE-2024-2195
CVSS V2 None
CVSS V3 None
Description
A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.
Overview
- CVE ID
- CVE-2024-2195
- Assigner
- @huntr_ai
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-04-10T17:08:12.635Z
- Last Modified Date
- 2024-04-16T11:10:40.863Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-2195 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2195 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 23:53:18 | Added to TrackCVE |