PT-2024-37593 · Aimhubio · Aim

Published 2024-07-12 · Updated 2025-07-23 · CVE-2024-6396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.19.3

Description The issue arises from improper handling of the run hash and repo.path parameters in the backup run function, allowing remote attackers to manipulate these parameters and create or write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

Recommendations For aimhubio/aim version 3.19.3, as a temporary workaround, consider disabling the backup run function until a patch is available. Restrict access to the repo.path parameter to minimize the risk of exploitation. Avoid using the run hash parameter in the affected function until the issue is resolved.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-6396

Affected Products

Aim

References · 6

• 🔥 https://huntr.com/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6396 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6396 · Vendor Advisory
• https://t.me/cveNotify/130050 · Telegram Post
• https://t.me/cvedetector/700 · Telegram Post
• https://t.me/cvenotify/85964 · Telegram Post