CVE-2024-10073
flairNLP flair Mode File Loader clustering.py ClusteringModel code injection
- State
- Published
- Severity
- 6.3 Medium
- Published
- Oct 17, 2024
- Updated
- Oct 17, 2024
- Reserved
- Oct 17, 2024
Description
A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 5.0 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 5.0 Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 5.1 Medium | AV:N/AC:H/Au:N/C:P/I:P/A:P | VulDB |
Weaknesses
- CWE-94 Code Injection
Affected Products
| Product | Versions |
|---|---|
flairflairNLP |
|
References
- VDB-280722 | flairNLP flair Mode File Loader clustering.py ClusteringModel code injectionvdb-entrytechnical-description
- VDB-280722 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #420055 | flairNLP flair v0.14.0 Code Injectionthird-party-advisory
- https://github.com/bayuncao/vul-cve-20related
- https://github.com/bayuncao/vul-cve-20/blob/main/PoC.pyexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.