Paddlepaddle CVE-2024-0521

HIGH

Code Injection (CWE-94)

2024-01-20 security@huntr.dev

RCE Code Injection Paddlepaddle Paddle

7.8

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

1

CVE Published

Jan 20, 2024 - 21:15 nvd

HIGH 7.8

DescriptionNVD

Code Injection in paddlepaddle/paddle

AnalysisAI

Code Injection in paddlepaddle/paddle. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Affected products include: Paddlepaddle Paddle.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.

More in Paddlepaddle

View all

CVE-2024-0917 CRITICAL Act Now POC

remote code execution in paddlepaddle/paddle 2.6.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely e

CVE-2023-38673 CRITICAL Act Now POC

PaddlePaddle before 2.5.0 has a command injection in fs.py. Rated critical severity (CVSS 9.8), this vulnerability is re

CVE-2023-38671 CRITICAL Act Now POC

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. Rated critical severity (CVSS 9.8), this vulnerabilit

CVE-2023-38669 CRITICAL Act Now POC

Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. Rated critical severity (CVSS 9.8), this vulnerability i

CVE-2022-46742 CRITICAL Act Now POC

Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. Rated cr

CVE-2022-45908 CRITICAL Act Now POC

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on

CVE-2022-31523 CRITICAL Act Now POC

The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file fu

CVE-2024-0818 CRITICAL Act Now POC

Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6. Rated critical severity (CVSS 9.1), this

CVE-2022-46741 CRITICAL Act Now POC

Out-of-bounds read in gather_tree in PaddlePaddle before 2.4. Rated critical severity (CVSS 9.1), this vulnerability is

CVE-2024-0815 HIGH This Week POC

Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0. Rated high sever

CVE-2024-0817 HIGH This Week POC

Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0. Rated high severity (CVSS 7.8), this vulnerability is lo

CVE-2024-1603 HIGH This Week POC

paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file. Rated high severity (CVSS 7.5), th

Same weakness CWE-94 – Code Injection

View all

CVE-2023-3519 CRITICAL POC

CVE-2021-22205 CRITICAL POC

CVE-2012-0158 HIGH POC

CVE-2021-44529 CRITICAL POC

CVE-2014-6287 CRITICAL POC

CVE-2017-7494 CRITICAL POC

CVE-2013-3906 HIGH POC

CVE-2017-9822 HIGH POC

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

CVE-2017-7269 CRITICAL POC

CVE-2022-47966 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2023-3519 CRITICAL POC

CVE-2015-5119 CRITICAL POC

CVE-2016-4117 CRITICAL POC

CVE-2015-3113 CRITICAL POC

Share

CVE-2024-0521 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy