CVE-2024-8438highCWE-22

CVE-2024-8438: falha de alta gravidade em modelscope/agentscope

Path Traversal in modelscope/agentscope

Publicada em

Seguir esta CVE+ Monitorar modelscope/agentscope+ Monitorar agentscope

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
modelscope · modelscope/agentscope
CVEs relacionadas — modelscope/agentscope

No mesmo produto, das mais perigosas para as menos.

CVE-2024-8502CRITICALRemote Code Execution via Deserialization in modelscope/agentscopeEPSS 1.8%CVE-2024-8524HIGHDirectory Traversal in modelscope/agentscopeEPSS 1.2%CVE-2024-8537CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8551CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2024-8550HIGHLocal File Inclusion (LFI) in modelscope/agentscopeEPSS 0.5%