CVE-2024-1603: confirmed
Published Mar 23, 2024
·Updated
paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.readfile.
Affected Software
2 affected components
pip/paddlepaddle<=2.6.0
PaddlePaddle paddlepaddle=2.6.0
Event History
Mar 23, 2024
CVE Published
via MITRE·06:24 PM
Data Sourced
via MITRE·06:24 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-1603?
CVE-2024-1603 has a medium severity rating due to the potential for arbitrary file read vulnerabilities in paddle.vision.ops.read_file.
2
How do I fix CVE-2024-1603?
To fix CVE-2024-1603, upgrade to PaddlePaddle versions later than 2.6.0 where the issue is resolved.
3
What type of vulnerability is CVE-2024-1603?
CVE-2024-1603 is classified as an arbitrary file read vulnerability affecting PaddlePaddle.
4
Which versions of PaddlePaddle are affected by CVE-2024-1603?
CVE-2024-1603 affects PaddlePaddle version 2.6.0.
5
Can CVE-2024-1603 be exploited remotely?
Yes, CVE-2024-1603 can potentially be exploited remotely, allowing attackers to read arbitrary files on the server.