Description

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production.

TorchServe Management API is designed to be accessed inside trusted environments. It's not recommended to have TorchServe Management API publicly accessible.

Remediation

It's recommended to restrict access to this service on production systems

References

ShellTorch: Multiple Critical Vulnerabilities in PyTorch Model Server (TorchServe)

Related Vulnerabilities

WordPress Plugin GlotPress Information Disclosure (2.2.1)

ReviveAdserver Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-7368)

Magento Config File Disclosure

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-0701)

ReviveAdserver Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-9129)

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure Configuration