CVE-2024-7340

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

Score

CVSS 3.1 8.8 High

Status

Deferred - reefs@jfrog.com

Published

2024-07-31

Last modified

2024-11-25

Weaknesses

CWE-20, CWE-22

Affected products

• Weave (Weights & Biases)

References

• https://github.com/wandb/weave/pull/1657
• https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248/