CVE-2024-8026: CSRF due to overly permissive CORS headers in netease-youdao/qanything
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8026?
CVE-2024-8026 has been classified as a medium severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2024-8026?
To mitigate CVE-2024-8026, restrict the CORS headers in the backend API to only allow trusted origins.
Which software is affected by CVE-2024-8026?
CVE-2024-8026 affects the backend API of Netease Youdao QAnything.
What type of vulnerability is CVE-2024-8026?
CVE-2024-8026 is a Cross-Site Request Forgery (CSRF) vulnerability.
What impact does CVE-2024-8026 have?
CVE-2024-8026 allows unauthorized actions on behalf of authenticated users due to overly permissive CORS headers.