VulnerabilityDeferred

CVE-2024-11602

A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0.

HIGH 7.4EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.

CVSS 3.0: 7.4 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-346
Source: security@huntr.dev

References

https://huntr.com/bounties/7b24ecbe-0af7-4125-ab56-bce09786042e

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.