7.5
CVE-2024-8550
- EPSS 0.48%
- Veröffentlicht 10.02.2025 19:15:39
- Zuletzt bearbeitet 30.07.2025 01:02:10
- Quelle security@huntr.dev
- CVE-Watchlists
- Unerledigt
LoginLocal File Inclusion (LFI) in modelscope/agentscope
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Modelscope ≫ Agentscope Version0.0.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.48% | 0.376 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@huntr.dev | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea