CVE-2024-7760

critical · 9.6

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.

9.6

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2025-03-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-352

Affected products

Vendor	Product	Affected versions
aimstack	aim	3.22.0

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-7760