CVE-2024-6577 - CVE House
Back to Database
Status published Medium CVE-2024-6577

Unclaimed S3 Bucket Usage in pytorch/serve

Vulnerability Description

In the latest version of pytorch/serve, the script 'upload_results_to_s3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not properly secured or claimed by the appropriate entity. The issue may result in data breaches, exposure of proprietary information, or unauthorized modifications to stored data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6577

Credits & Attribution

No credits recorded in the NVD database.

References

More from pytorch

View All →
CVE-2025-32434
PyTorch: `torch.load` with `weights_only=True` leads to remote code execution
Critical 9.3
CVE-2024-35199
TorchServe gRPC Port Exposure
High 8.2
CVE-2024-35198
TorchServe bypass allowed_urls configuration
Critical 9.8
CVE-2023-48299
TorchServe ZipSlip
Medium 5.3
CVE-2023-43654
TorchServe Server-Side Request Forgery
Critical 10

Affected Vendor

Affected Software

pytorch/serve
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-840

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.