CVE-2023-6020: Ray Static File Local File Include
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/rayto a version that resolves this vulnerability.Fixed in 2.8.1 - Upgrade
Upgrade
Rayto a version that resolves this vulnerability.Fixed in 2.8.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-6020?
CVE-2023-6020 is a vulnerability in Ray's /static/ directory that allows attackers to read any file on the server without authentication.
How severe is CVE-2023-6020?
CVE-2023-6020 has a severity level of 9.3 (critical).
Which software is affected by CVE-2023-6020?
Ray Project Ray is affected by CVE-2023-6020.
How can an attacker exploit CVE-2023-6020?
An attacker can exploit CVE-2023-6020 by accessing the /static/ directory in Ray and reading any file on the server without authentication.
Is there a fix for CVE-2023-6020?
There is currently no fix available for CVE-2023-6020, but it is recommended to update Ray and apply any security patches or mitigations provided by the vendor.