CVE-2024-12216
Last modified
CVE-2024-12216 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
A vulnerability in the `ImageClassificationDataset.from_csv()` API of the `dmlc/gluon-cv` repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts `tar.gz` files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can exploit this by crafting malicious tar files that, when extracted, can overwrite files on the victim's system via path traversal or faked symlinks.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-12216?
How severe is CVE-2024-12216?
How do I fix CVE-2024-12216?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-12210The Print Invoice & Delivery Notes for WooCommerce plugin fo…4.3
- CVE-2024-12211Pega Platform versions 8.1 to Infinity 24.2.0 are affected b…5.4
- CVE-2024-12212The vulnerability occurs in the parsing of CSP files. The is…8.5
- CVE-2024-12213The WP Job Board Pro plugin for WordPress is vulnerable to p…9.8
- CVE-2024-12214The WooCommerce HSS Extension for Streaming Video plugin for…6.1
- CVE-2024-12215In kedro-org/kedro version 0.19.8, the `pull_package()` API …8.8
- CVE-2024-12217A vulnerability in the gradio-app/gradio repository, version…5.3
- CVE-2024-12218The Woocommerce check pincode/zipcode for shipping plugin fo…6.1
- CVE-2024-12219The Stop Registration Spam plugin for WordPress is vulnerabl…6.1
- CVE-2024-1222This allows attackers to use a maliciously formed API reques…9.8
- CVE-2024-12220The SMS for WooCommerce plugin for WordPress is vulnerable t…6.1
- CVE-2024-12221The Turnkey bbPress by WeaverTheme plugin for WordPress is v…6.1
Are you affected by CVE-2024-12216?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST