CRITICAL🇵🇱 Wersja polska

CVE-2024-7760

CVSS 9.6v3.1pub. 2025-03-20upd. 2025-07-21

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

  • Aimstack Aim

    APP
    Aimstack
    3.22.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEDoS
CWE
References

Related vulnerabilities

CVE-2024-8769CRITICAL9.1PL ✓ten sam produkt

Aimstack Aim: path traversal umożliwiający usunięcie dowolnego pliku

CVE-2024-6829CRITICAL9.1PL ✓ten sam produkt

Path traversal w Aimstack Aim – zapis plików w dowolnej lokalizacji serwera

CVE-2024-6396CRITICAL9.8PL ✓ten sam produkt

Nadpisywanie plików i RCE w Aimstack Aim przez funkcję _backup_run

CVE-2024-2195CRITICAL9.8PL ✓ten sam produkt

RCE w Aimstack Aim – wykonanie kodu przez parametr query w API

CVE-2025-51463HIGH7.0ten sam produkt

Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the s...