CVE-2024-8556: fallo de gravedad media en modelscope/agentscope
Stored XSS in modelscope/agentscope
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.4%
probabilidad de explotación
0.4%top 65% de las CVE
explotación observada
noninguna fuente lo reporta
A stored cross-site scripting (XSS) vulnerability exists in modelscope/agentscope, as of the latest commit 21161fe on the main branch. The vulnerability occurs in the view for inspecting detailed run information, where a user-controllable string (run ID) is appended and rendered as HTML. This allows an attacker to execute arbitrary JavaScript code in the context of the user's browser.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
modelscope · modelscope/agentscopeCVEs relacionadas — modelscope/agentscope
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-8502CRITICALRemote Code Execution via Deserialization in modelscope/agentscopeEPSS 1.8%CVE-2024-8524HIGHDirectory Traversal in modelscope/agentscopeEPSS 1.2%CVE-2024-8537CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2024-8551CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8438HIGHPath Traversal in modelscope/agentscopeEPSS 0.8%