CVE-2024-6578

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6578

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6578.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6578

Aliases

Published

2024-07-29T18:37:16.820Z

Modified

2026-07-15T01:49:19.183442422Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS in aimhubio/aim

Details

A stored cross-site scripting (XSS) vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML function in React, which is susceptible to XSS attacks. An attacker can exploit this vulnerability by injecting malicious scripts into the logs, which will be executed when a user views the logs-tab.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6578.json"
}

References

Affected packages

Git / github.com/aimhubio/aim

Affected ranges

Type

GIT

Repo

https://github.com/aimhubio/aim

Events

Introduced

17cdf0b8fc1120363cb646028e43140bdf0abba1

Last affected

17cdf0b8fc1120363cb646028e43140bdf0abba1

Database specific

{
    "cpe": "cpe:2.3:a:aimstack:aim:3.19.3:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.19.3"
        },
        {
            "last_affected": "3.19.3"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*

3.19.3

v3.*

v3.19.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6578.json"