Stored Cross-Site Scripting Risk in Modelscope/Agentscope by Modelscope
CVE-2024-8556
6.1MEDIUM
What is CVE-2024-8556?
A stored cross-site scripting vulnerability has been identified in Modelscope/Agentscope. The issue arises when the application processes a user-controlled run ID that is subsequently rendered in HTML within the detailed run information view. This weakness enables attackers to inject and execute arbitrary JavaScript code in the user's browser, potentially compromising user data and security. It is essential for users of the affected product to follow best practices in web security and apply necessary updates to mitigate this risk.
Affected Version(s)
modelscope/agentscope <= unspecified
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
CVSS V3.0
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved