CVE-2023-38673
CriticalCVSS 9.6Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
PaddlePaddle before 2.5.0 has a command injection in fs.py, allowing for the execution of arbitrary commands on the operating system.
Risk Assessment
Exploitation of this vulnerability could lead to full control over the operating system, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade PaddlePaddle to version 2.5.0 or later to mitigate this vulnerability.
Other vulnerabilities in PaddlePaddle
See all- CVE-2023-38672Medium
There is an FPE vulnerability in paddle.trace in PaddlePaddle before version 2.5.0, which can lead to runtime crashes and denial of service.
- CVE-2023-38671High
Heap buffer overflow in paddle.trace in PaddlePaddle before version 2.5.0. This flaw can lead to denial of service, information disclosure, or more damage is possible.
- CVE-2023-38670Medium
A null pointer dereference in paddle.flip in PaddlePaddle before version 2.5.0 results in a runtime crash and denial of service.
- CVE-2023-38669High
There is a use after free vulnerability in paddle.diagonal in PaddlePaddle before version 2.5.0, leading to a potentially exploitable condition.
Original NVD description (English source)
PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.