CVE-2024-0815: confirmed
Published Mar 7, 2024
·Updated
Command injection in paddle.utils.download.wgetdownload (bypass filter) in paddlepaddle/paddle 2.6.0
Affected Software
2 affected components
pip/paddlepaddle<=2.6.0
PaddlePaddle paddlepaddle=2.6.0
Event History
Mar 7, 2024
CVE Published
via MITRE·03:13 AM
Data Sourced
via MITRE·03:13 AM
DescriptionSeverityWeakness
Advisory Published
via GitHub·06:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-0815?
CVE-2024-0815 is classified as a high severity vulnerability due to its potential for command injection.
2
How do I fix CVE-2024-0815?
To fix CVE-2024-0815, upgrade PaddlePaddle to a version newer than 2.6.0 that addresses the command injection issue.
3
What is the impact of CVE-2024-0815?
The impact of CVE-2024-0815 includes the possibility for remote attackers to execute arbitrary commands on the system.
4
Is CVE-2024-0815 a local or remote vulnerability?
CVE-2024-0815 is a remote vulnerability, allowing attackers to exploit the system without physical access.
5
Which versions of PaddlePaddle are affected by CVE-2024-0815?
CVE-2024-0815 affects PaddlePaddle version 2.6.0 and earlier.