Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-7760CSRF in aimhubio/aim
High 7.4
In plain English
A high-severity cross-site request forgery in aimhubio/aim from aimhubio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | aim | no fix listed | GHSA-38r9-3j52-h92v |
| PyPI | aim | no fix listed | PYSEC-2026-1082 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimhubio | aimhubio/aim | unspecified – through latest |
Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N