CVE-2024-8026

Published: Mar 20, 2025Modified: Mar 26, 2025

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.

Affected (1)

Products: Qanything: Qanything

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Qanything Qanything	Up to 2024-06-24

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://huntr.com/bounties/e57f1e32-0fe5-4997-926c-587461aa6274

Source: security@huntr.dev

ExploitThird Party Advisory

https://huntr.com/bounties/e57f1e32-0fe5-4997-926c-587461aa6274

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.