요약
- CVE-2024-6578은(는) aim, aim (aimstack)에 영향을 주는 보통 (CVSS 5.4) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.29%, 전체 취약점의 21.0%보다 높음.
- 아직 패치 버전 정보가 없습니다. 참고 자료의 공급업체 권고를 확인하세요.
| Package | Affected versions | Patched versions |
|---|
| aim PyPI | ≤ 3.19.3
| No fix yet |
| aim | = 3.19.3
| No fix yet |
Description
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
NVD description
A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the `dangerouslySetInnerHTML` function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free