CVE-2024-8551criticalCWE-23

CVE-2024-8551: critical vulnerability in modelscope/agentscope

Path Traversal in modelscope/agentscope

Published · Updated

Follow this CVE+ Monitor modelscope/agentscope+ Monitor agentscope

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.1epss 1.0%
A path traversal vulnerability exists in the save-workflow and load-workflow functionality of modelscope/agentscope versions prior to the fix. This vulnerability allows an attacker to read and write arbitrary JSON files on the filesystem, potentially leading to the exposure or modification of sensitive information such as configuration files, API keys, and hardcoded passwords.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
modelscope · modelscope/agentscope
Related CVEs — modelscope/agentscope

In the same product, most dangerous first.

CVE-2024-8502CRITICALRemote Code Execution via Deserialization in modelscope/agentscopeEPSS 1.8%CVE-2024-8524HIGHDirectory Traversal in modelscope/agentscopeEPSS 1.2%CVE-2024-8537CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2024-8438HIGHPath Traversal in modelscope/agentscopeEPSS 0.8%CVE-2024-8550HIGHLocal File Inclusion (LFI) in modelscope/agentscopeEPSS 0.5%