CVE-2024-7760: high-severity vulnerability in aimhubio/aim
CSRF in aimhubio/aim
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.4epss 0.5%
aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected products
aimhubio · aimhubio/aimRelated CVEs — aimhubio/aim
In the same product, most dangerous first.
CVE-2024-6396CRITICALArbitrary File Overwrite and Data Exfiltration in aimhubio/aimEPSS 53.1%CVE-2024-2195CRITICALRemote Code Execution in aimhubio/aimEPSS 1.8%CVE-2024-6851HIGHArbitrary File Deletion in aimhubio/aimEPSS 1.1%CVE-2024-8769CRITICALArbitrary File Deletion via Relative Path Traversal in aimhubio/aimEPSS 0.9%CVE-2024-6483MEDIUMArbitrary File/Directory Deletion in aimhubio/aimEPSS 0.9%CVE-2024-6829CRITICALArbitrary File Overwrite through tarfile-extraction in aimhubio/aimEPSS 0.9%