CVE-2024-4890

Blind SQL Injection in berriai/litellm

At a glance

Severity
MEDIUM 4.9
EPSS
EPSS 0.56 % · percentile 46 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
@huntr_ai
NVD status
Modified

Description

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

Scores

VersionScoreVectorScored by
CVSS 3.0MEDIUM 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N@huntr_ai
CVSS 3.1MEDIUM 4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.0MEDIUM 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · security@huntr.dev (Secondary)

Weaknesses (CWE)

Advisories

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
berriai · berriai/litellmaffected unspecified ≤ latest

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD