In breve
- CVE-2024-6578 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda aim, aim (aimstack).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.29%, superiore al 21.0% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
| Package | Affected versions | Patched versions |
|---|
| aim PyPI | ≤ 3.19.3
| No fix yet |
| aim | = 3.19.3
| No fix yet |
Description
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
NVD description
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free