CVE-2024-4890: Blind SQL Injection in berriai/litellm
A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'userid' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
berriai/litellmto a version that resolves this vulnerability.Fixed in 1.27.14
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4890?
CVE-2024-4890 is classified as a critical severity vulnerability due to its potential for unauthorized data manipulation.
How do I fix CVE-2024-4890?
To fix CVE-2024-4890, update the litellm application to version 1.27.15 or later, which includes the necessary security patches.
What is the impact of CVE-2024-4890?
The impact of CVE-2024-4890 allows attackers to execute unauthorized SQL queries, potentially leading to data breaches.
Who is affected by CVE-2024-4890?
CVE-2024-4890 affects users of the litellm application version 1.27.14 and earlier.
What causes CVE-2024-4890?
CVE-2024-4890 is caused by improper handling of the 'user_id' parameter in raw SQL queries used within the application.