Arbitrary File Download Vulnerability in Modelscope by AI Company
CVE-2024-8501

8.8HIGH

Key Information:

Vendor

Modelscope

Status
Modelscope/agentscope
Vendor
CVE Published:
20 March 2025

What is CVE-2024-8501?

An arbitrary file download vulnerability has been identified in the rpc_agent_client component of Modelscope, specifically affecting version v0.0.4. This vulnerability enables users to exploit the download_file method, allowing them to download any file stored on the host of the rpc_agent. As a result, unauthorized access to sensitive information, including configuration files and credentials, may occur, potentially leading to further security breaches such as privilege escalation or lateral movement across the network.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

modelscope/agentscope <= unspecified

References

https://huntr.com/bounties/83e433c0-ed2d-4b10-8358-d3c1ee...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.