// For flags

CVE-2024-4890

Blind SQL Injection in berriai/litellm

Severity Score

4.9
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

Existe una vulnerabilidad de inyección SQL ciega en la aplicación berriai/litellm, específicamente dentro del proceso '/team/update'. La vulnerabilidad surge debido al manejo inadecuado del parámetro 'user_id' en la consulta SQL sin formato utilizada para eliminar usuarios. Un atacante puede aprovechar esta vulnerabilidad inyectando comandos SQL maliciosos a través del parámetro 'user_id', lo que lleva a un posible acceso no autorizado a información confidencial como claves API, información de usuario y tokens almacenados en la base de datos. La versión afectada es la 1.27.14.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Multiple
Confidentiality
Complete
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-05-14 CVE Reserved
  • 2024-06-06 CVE Published
  • 2024-08-01 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Berriai
Search vendor "Berriai"
 Litellm
Search vendor "Berriai" for product "Litellm"
*-
Affected
Litellm
Search vendor "Litellm"
 Litellm
Search vendor "Litellm" for product "Litellm"
*-
Affected