CVE-2024-5710
Last modified
CVE-2024-5710 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vulnerability allows attackers to perform unauthorized actions such as creating, updating, viewing, deleting, blocking, and unblocking any teams, as well as adding or deleting any member to or from any teams. The vulnerability stems from insufficient access control checks in various team management endpoints, enabling attackers to exploit these functionalities without proper authorization.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Litellm | Litellm | 1.34.34 |
References
- https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970Exploit, Third Party Advisory
- https://huntr.com/bounties/70897f59-a966-4d93-b71e-745e3da91970Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-5710?
How severe is CVE-2024-5710?
How do I fix CVE-2024-5710?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-5709The WPBakery Visual Composer plugin for WordPress is vulnera…8.8
- CVE-2024-57095SQL injection vulnerability in Go-CMS v.1.1.10 allows a remo…6.8
- CVE-2024-57096An issue in wps office before v.19302 allows a local attacke…5.5
- CVE-2024-57097ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in …4.8
- CVE-2024-57098Moss v0.1.3 version has an SQL injection vulnerability that …9.8
- CVE-2024-57099ClassCMS v4.8 has a code execution vulnerability. Attackers …9.8
- CVE-2024-5711A stored Cross-Site Scripting (XSS) vulnerability exists in …6.1
- CVE-2024-5712A Cross-Site Request Forgery (CSRF) vulnerability was identi…8.1
- CVE-2024-5713The If-So Dynamic Content Personalization WordPress plugin b…5.4
- CVE-2024-5714In lunary-ai/lunary version 1.2.4, an improper access contro…6.8
- CVE-2024-5715The wp-eMember WordPress plugin before 10.6.7 does not sanit…7.1
- CVE-2024-57151SQL Injection vulnerability in rainrocka xinhu v.2.6.5 and b…6.8
Are you affected by CVE-2024-5710?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST