CVE-2024-9526CWE-79

Stored XSS in Kubeflow Pipeline View

High · published November 18, 2024

CVSS v4.0
7.1
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green
EPSS
0.00212 · 11.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-11-18T13:30Z
EPSS history
Timeline
  • 18 NOV 13:30Z
    Stored XSS in Kubeflow Pipeline View
    cvelistv5