Insecure Temporary File in huggingface/transformers
CVE-2023-2800

4.7MEDIUM

Key Information:

Vendor

Huggingface

Status
Huggingface/transformers
Vendor
CVE Published:
18 May 2023

What is CVE-2023-2800?

Insecure Temporary File in GitHub repository huggingface/transformers prior to 4.30.0.

Affected Version(s)

huggingface/transformers < 4.30.0

References

https://huntr.dev/bounties/a3867b4e-6701-4418-8c20-3c6e70...
https://github.com/huggingface/transformers/commit/80ca92...

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.