CVE-2024-8489CWE-352

CSRF due to overly permissive CORS headers in modelscope/agentscope

High · published March 20, 2025

CVSS v3.0
8.8
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, including the `api/file` endpoint, enabling the reading of arbitrary files on the target's local file system through CSRF.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    CSRF due to overly permissive CORS headers in modelscope/agentscope
    cvelistv5