CVE-2024-2196CWE-352

CSRF Vulnerability in aimhubio/aim

High · published April 10, 2024

CVSS v3.0
8.8
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboard. An attacker can exploit this by tricking a user into executing a malicious script that sends unauthorized requests to the aim server, leading to potential data loss and unauthorized data manipulation.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00587 · 47.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-04-10T17:08Z
EPSS history
Timeline
  • 10 APR 17:08Z
    CSRF Vulnerability in aimhubio/aim
    cvelistv5