AIMHUBIO Aim Hacked: Path Traversal Vulnerability Affects User Data

CVE-2024-6396
9.8CRITICAL

Key Information

Vendor
Aimhubio
Status
Aimhubio/aim
Vendor
CVE Published:
12 July 2024

Summary

A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

Affected Version(s)

aimhubio/aim <= unspecified

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Risk change from: null to: 9.8 - (CRITICAL)

  • Vulnerability published.

Collectors

NVD DatabaseMitre Database
.