PT-2025-12163 · Pypi · Pytorch/Serve

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-6577

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions pytorch/serve (affected versions not specified)

Description The issue concerns the script 'upload results to s3.sh' referencing the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The problem may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-840

Related Identifiers

CVE-2024-6577

GHSA-XX7C-J7H3-VJCQ

Affected Products

Pytorch/Serve

References · 5

• https://osv.dev/vulnerability/GHSA-xx7c-j7h3-vjcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6577 · Security Note
• https://github.com/pytorch/serve · Note
• https://twitter.com/CVEnew/status/1902671092545896530 · Twitter Post
• https://huntr.com/bounties/20917570-8328-428f-bd1d-4fcd71fb2359 · Note