aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229 | Exploit Third Party Advisory |
Configurations
History
21 Jul 2025, 19:47
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Aimstack aim
Aimstack |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
| References | () https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:aimstack:aim:3.22.0:*:*:*:*:python:*:* |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-21 19:47
NVD link : CVE-2024-7760
Mitre link : CVE-2024-7760
JSON object : View
Products Affected
aimstack
- aim
CWE
CWE-352
Cross-Site Request Forgery (CSRF)