Vulnerability · Published Nov 18, 2024 · Assigned by Google

CVE-2024-9526Stored XSS in Kubeflow Pipeline View

High 7.1

In plain English

A high-severity cross-site scripting in Kubeflow Pipeline View from Kubeflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 86.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kubeflow/pipelines	no fix listed	GO-2024-3278

Affected products (as reported)

Vendor	Product	Versions
Kubeflow	Kubeflow Pipeline View	0 – before 930c35f1c543998e60e8d648ce93185c9b5dbe8d

Weakness: CWE-79 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green

References

https://github.com/kubeflow/pipelines/pull/10315