Path Traversal in Polyaxon Polyaxon/polyaxon
CVE-2024-9363
An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as `polyaxon.sock`, causing the API container to exit unexpectedly. This disrupts related services and prevents the system from functioning normally, without requiring authentication or UUID parameters.
EPSS: 0.010 (58.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Polyaxon Polyaxon/polyaxon — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-9363?
- CVE-2024-9363 is a high-severity vulnerability in Polyaxon Polyaxon/polyaxon, classified under Relative Path Traversal. CVSS score: 7.5/10. Published 2025-03-20.
- How severe is CVE-2024-9363?
- High severity. CVSS v3 base score is 7.5 out of 10.