VulnerabilityDeferred

CVE-2024-9365

A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser.

MEDIUM 6.5EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

A Cross-Site Request Forgery (CSRF) vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability includes potential data loss and service disruption.

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: 0.24% probability · 15th percentile
CISA KEV: Not listed
Weakness: CWE-352
Source: security@huntr.dev

References

https://huntr.com/bounties/cdfa012b-a694-4beb-9a9a-12a9dde07ef9

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.