CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. Its EPSS score suggests a 74.6% probability of exploitation in the next 30 days. It may be remotely exploitable.
CVE
CVE-2023-6019
Severity
CRITICAL
CVSS
9.8
EPSS
74.63%
Original NVD Description
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
Related CVEs
Other vulnerabilities affecting the same vendor(s)