CVE-2024-8061

Description

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-1088 CWE-1088

Affected Products

Vendor	Product	Versions
aimstack	aim	All

References

Exploits

https://huntr.com/bounties/c85d005c-b354-4c51-a88f-adda2f09622b

Frequently Asked Questions

What is CVE-2024-8061? +

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to wait indefinitely for a response. This can lead to a denial of service, as the tracking server does not respond to other requests while waiting. The issue arises in the client used by the `aim` tracking server to communicate with external resources, specifically in the `_run_read_instructions` method and similar calls without timeouts. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-8061? +

CVE-2024-8061 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-8061? +

CVE-2024-8061 affects products from aimstack, specifically: aim. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-8061? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-8062 7.5

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a …

CVE-2024-12777 5.9

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking …

CVE-2025-4656 3.1

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled …

CVE-2024-6396 9.8

A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host …

CVE-2024-2195 9.8

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions …

CVE-2024-7760 9.6

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly …