CVE-2023-48023

{"id": "CVE-2023-48023", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-11-28T08:15:07.060", "references": [{"url": "https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://docs.ray.io/en/latest/ray-security/index.html", "tags": ["Product", "Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment"}, {"lang": "es", "value": "Anyscale Ray 2.6.3 y 2.8.0 permite /log_proxy SSRF. NOTA: la posici\u00f3n del proveedor es que este informe es irrelevante porque Ray, como se indica en su documentaci\u00f3n, no est\u00e1 manipulado para su uso fuera de un entorno de red estrictamente controlado."}], "lastModified": "2024-04-11T01:22:08.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anyscale:ray:2.6.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1083D908-E7F7-44BE-89CD-B760224C5585"}, {"criteria": "cpe:2.3:a:anyscale:ray:2.8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE882370-6570-49E0-A11F-95D3FBCD4714"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}