CVE-2024-8489highCWE-352

CVE-2024-8489: falha de alta gravidade em modelscope/agentscope

CSRF due to overly permissive CORS headers in modelscope/agentscope

Publicada em

Seguir esta CVE+ Monitorar modelscope/agentscope

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.2%
A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, including the `api/file` endpoint, enabling the reading of arbitrary files on the target's local file system through CSRF.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
modelscope · modelscope/agentscope
CVEs relacionadas — modelscope/agentscope

No mesmo produto, das mais perigosas para as menos.

CVE-2024-8502CRITICALRemote Code Execution via Deserialization in modelscope/agentscopeEPSS 1.8%CVE-2024-8524HIGHDirectory Traversal in modelscope/agentscopeEPSS 1.2%CVE-2024-8537CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8551CRITICALPath Traversal in modelscope/agentscopeEPSS 1.0%CVE-2024-8501HIGHArbitrary File Download in modelscope/agentscopeEPSS 1.0%CVE-2024-8438HIGHPath Traversal in modelscope/agentscopeEPSS 0.8%