CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d

CVSS

No CVSS.

References

Link	Resource
https://github.com/kubeflow/pipelines/pull/10315

Configurations

No configuration.

History

18 Nov 2024, 17:11

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de XSS almacenada en la interfaz web de Kubeflow Pipeline View. La interfaz web de Kubeflow permite crear nuevas canalizaciones. Al crear una nueva canalización, es posible agregar una descripción. El campo de descripción permite etiquetas HTML, que no se filtran correctamente. Esto genera un XSS almacenado. Recomendamos actualizar la versión anterior a el commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d

18 Nov 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-18 14:15

Updated : 2024-11-18 17:11

NVD link : CVE-2024-9526

Mitre link : CVE-2024-9526

CVE.ORG link : CVE-2024-9526

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-9526", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@google.com", "cvssData": {"safety": "PRESENT", "version": "4.0", "recovery": "USER", "baseScore": 7.1, "automatable": "YES", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:L/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "subsequentSystemAvailability": "LOW", "vulnerableSystemAvailability": "LOW", "subsequentSystemConfidentiality": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-11-18T14:15:05.873", "references": [{"url": "https://github.com/kubeflow/pipelines/pull/10315", "source": "cve-coordination@google.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@google.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.\u00a0The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit\u00a0930c35f1c543998e60e8d648ce93185c9b5dbe8d"}, {"lang": "es", "value": "Existe una vulnerabilidad de XSS almacenada en la interfaz web de Kubeflow Pipeline View. La interfaz web de Kubeflow permite crear nuevas canalizaciones. Al crear una nueva canalizaci\u00f3n, es posible agregar una descripci\u00f3n. El campo de descripci\u00f3n permite etiquetas HTML, que no se filtran correctamente. Esto genera un XSS almacenado. Recomendamos actualizar la versi\u00f3n anterior a el commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d"}], "lastModified": "2024-11-18T17:11:17.393", "sourceIdentifier": "cve-coordination@google.com"}