Ray Serve gRPC handler vulnerability
Date: 2024-05
Affected: ray < 2.20.0
Attack vector: xss
Category: real-world
Severity: High
CVE: CVE-2024-28199
CVE-2024-32970
CWE: CWE-79
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

Vulnerability in Ray Serve (gRPC path) that can be exploited by remote attackers under certain conditions. Fixed in Ray 2.20.0.


Mitigations:

Architectural layers (MAESTRO):