CVE-2024-8024

HIGH

netease-youdao/qanything <1.4.1 - SSRF

Title source: llm

Description

A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security issues.

References (1)

[Exploit, Third Party Advisory] https://huntr.com/bounties/bda53fab-88aa-4e03-8d9d-4cf50a98ffc7

Scores

CVSS v3 7.5

EPSS 0.0005

EPSS Percentile 16.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-346

Status published

Affected Products (1)

youdao/qanything

Timeline

Published Mar 20, 2025

Tracked Since Feb 18, 2026