En bref
- CVE-2024-6578 est une vulnérabilité MOYENNE (CVSS 5.4) touchant aim, aim (aimstack).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.29%, plus élevée que 21.0% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| aim PyPI | ≤ 3.19.3
| No fix yet |
| aim | = 3.19.3
| No fix yet |
Description
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
NVD description
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free