CVE-2023-6020: ray_project ray Missing Authorization
CVSS: 7.5v3.0HighModified
AliasesGHSA-6cxr-8q3m-jwrrPYSEC-2026-516
Published 16-11-2023Last modified 02-08-2024
Vulnerability summary
CVE-2023-6020 is a high (CVSS 7.5) Missing Authorization vulnerability in ray_project ray. EPSS estimates a 14.65% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
7.5/10
010
High · v3.0 (CVE.org)EPSS score
14.65%
0%100%
Medium · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference, metasploit
Timeline
- 16-11-2023PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesSingle source
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSources3 sources · 7.5–9.3
- OSV · PypiEcosystem advisory · calculated9.3CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NDiffers
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
14.65%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 14.65% on 20-09-2026
20-09-202620-10-2026
EPSS score14.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (huntr.com)
Maturity: unknown
Ray static arbitrary file read
auxiliary/gather/ray_lfi_cve_2023_6020
Maturity: poc
Weaknesses
CWE · root causeAffected systems
PyPI1 product
- ray< 2.8.1
Ray_project1 product
- rayna
Ray-project1 product
- ray-project/ray≥ unspecified, ≤ latest
3 vendors · 3 products
References
7 links
- pypi.org/project/rayPACKAGE