CVE-2023-6021

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-6021 is a local file inclusion vulnerability in the log API endpoint of Ray, an open-source distributed computing framework. The flaw stems from improper input validation that permits path traversal, allowing unauthenticated remote access to arbitrary files on the underlying server. It is tracked under CWE-22 and CWE-29 and carries a CVSS 3.1 base score of 7.5 reflecting network attack vector, low complexity, and high confidentiality impact without any required credentials.

An attacker with network access to the Ray log endpoint can supply crafted requests to retrieve sensitive files such as configuration data, credentials, or source code. No authentication or user interaction is needed, enabling straightforward information disclosure that could facilitate further compromise of the host or connected systems.

The maintainers state that the issue is resolved in Ray version 2.8.1 and later; their detailed response and guidance are published at the referenced Anyscale advisory. The associated EPSS score stands at 0.8732 with an identical recorded peak, indicating sustained high exploitation probability since disclosure.