{"id":"CVE-2023-6021","published":"2023-11-16T16:11:42Z","modified":"2024-11-27T17:07:03Z","title":"Ray Log File Local File Include","vendor":"ray-project","product":"ray-project/ray","tier":"core","eol":null,"affectedVersions":[{"vendor":"ray-project","product":"ray-project/ray","versions":[">= unspecified, <= latest"]}],"description":{"text":"LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a local file inclusion (path traversal) vulnerability in the log API endpoint of Ray, the ray-project/ray product. An attacker can read arbitrary files on the server over the network without authenticating and without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:36Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.37076,"percentile":0.98517,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-29","name":"Path Traversal: '..filename'"}],"references":[{"url":"https://huntr.com/bounties/5039c045-f986-4cbc-81ac-370fe4b0d3f8","tags":[]}],"techniques":[],"reports":[{"id":"SRC-21b639fa149328c86d0e","title":"ShadowRay: First Known Attack Campaign Targeting AI Workloads Exploited In The Wild","publisher":"oligo.security","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild","date":null,"mentions":[{"quote":"https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023‍[2] https://bishopfox.com/blog/ray-versions-2-6-3-2-8-0‍[3] https://huntr.com/bounties/787a07c0-5535-469f-8c53-3efa4e5717c7/‍[4]","start":25028,"end":25277}]}],"affected":[{"ecosystem":"PyPI","package":"ray","vulnerableRanges":["<2.8.1"],"patched":["2.8.1"],"from":["GHSA-3pww-qvr8-6mhp","PYSEC-2026-515"],"provenance":"source"}],"advisories":[{"id":"GHSA-3pww-qvr8-6mhp","url":"https://github.com/advisories/GHSA-3pww-qvr8-6mhp","severity":"CRITICAL","ecosystem":"PyPI","package":"ray","vulnerableRanges":["<2.8.1"],"patched":["2.8.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2864","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2864","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2023-6021","name":"Ray API - Local File Inclusion","severity":"high","path":"http/cves/2023/CVE-2023-6021.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6021.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-11-16","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-6021","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":33.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.7,"detail":"percentile 0.9852"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}