CVE-2024-8537: fallo crítico en modelscope/agentscope
Path Traversal in modelscope/agentscope
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 1.0%
A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
modelscope · modelscope/agentscopeCVEs relacionadas — modelscope/agentscope
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-8502CRITICALRemote Code Execution via Deserialization in modelscope/agentscopeEPSS 1.8%CVE-2024-8524HIGHDirectory Traversal in modelscope/agentscopeEPSS 1.2%CVE-2024-8551CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2024-8438HIGHPath Traversal in modelscope/agentscopeEPSS 0.8%CVE-2024-8550HIGHLocal File Inclusion (LFI) in modelscope/agentscopeEPSS 0.5%