1  info:
 2    name: LiteLLM
 3    cve: CVE-2024-4890
 4    summary: SQL injection vulnerability in litellm's '/team/update' process.
 5    details: |
 6      A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. 
 7      The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. 
 8      An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential 
 9      unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. 
10      The affected version is 1.27.14.
11    cvss: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
12    severity: HIGH
13    security_advise: |
14      1. Upgrade to a patched version of litellm.
15      2. Implement proper input validation and parameterized queries to prevent SQL injection.
16      3. Review and sanitize all user-supplied input before using it in database queries.
17  rule: version <= "1.27.14"
18  references:
19    - https://nvd.nist.gov/vuln/detail/CVE-2024-4890
20    - https://github.com/BerriAI/litellm/pull/2954
21    - https://github.com/BerriAI/litellm
22    - https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2