Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · Ray

CVE-2023-6020: Ray Missing Authorization vulnerability

criticalCVSS 3.0 9.3GHSA-6cxr-8q3m-jwrr

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Published Nov 16, 2023 · Updated Jan 9, 2025

Affected packages

ray

Ecosystem
PyPI
Affected
< 2.8.1
Fixed in
2.8.1
Check
pip show ray

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023

Credited to cpropps-sysdig.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Ray vulnerabilities

All Ray entries