CVE-2024-4890

Blind SQL Injection in berriai/litellm

En bref

Sévérité
MEDIUM 4.9
EPSS
EPSS 0.56 % · centile 46 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
@huntr_ai
Statut NVD
Modified

Description

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.0MEDIUM 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N@huntr_ai
CVSS 3.1MEDIUM 4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.0MEDIUM 4.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NNVD · security@huntr.dev (Secondary)

Faiblesses (CWE)

Avis

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
berriai · berriai/litellmaffected unspecified ≤ latest

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD