CVE-2023-31036
Assigner: nvidia
Published: 2024-01-12T17:11:38.579Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Triton Inference Server
vendor: nvidia
versions: status: affected
version: All versions prior to 2.40
descriptions: supportingMedia: base64: yes
type: text/html
value: NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
value: NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
impacts: descriptions: value: Code execution, denial of service, escalation of privileges, information disclosure, and data tampering
metrics: cvssV3_1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-23
description: CWE-23
type: CWE
source: discovery: UNKNOWN
title: CVE