What is CVE-2024-7760?

CVE-2024-7760 is a critical-severity vulnerability in Aimhubio Aimhubio/aim, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.6/10. Published 2025-03-20.

How severe is CVE-2024-7760?

Critical severity. CVSS v3 base score is 9.6 out of 10.

CSRF in Aimhubio Aimhubio/aim

CVE-2024-7760

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.005 (38.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Aimhubio Aimhubio/aim — versions unspecified
Aimstack Aim — versions 3.22.0

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-7760?: CVE-2024-7760 is a critical-severity vulnerability in Aimhubio Aimhubio/aim, classified under Cross-Site Request Forgery (CSRF). CVSS score: 9.6/10. Published 2025-03-20.
How severe is CVE-2024-7760?: Critical severity. CVSS v3 base score is 9.6 out of 10.