CSRF in Modelscope Modelscope/agentscope
CVE-2024-8489
A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, including the `api/file` endpoint, enabling the reading of arbitrary files on the target's local file system through CSRF.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.002 (12.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Modelscope Modelscope/agentscope — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-8489?
- CVE-2024-8489 is a high-severity vulnerability in Modelscope Modelscope/agentscope, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2025-03-20.
- How severe is CVE-2024-8489?
- High severity. CVSS v3 base score is 8.8 out of 10.