CVE-2024-9526: Stored XSS in Kubeflow Pipeline View
There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9526?
CVE-2024-9526 has been classified as a high severity vulnerability due to its potential for stored XSS attacks.
How do I fix CVE-2024-9526?
To fix CVE-2024-9526, update your Kubeflow Pipeline View to a version that properly sanitizes the description field.
Who is affected by CVE-2024-9526?
CVE-2024-9526 affects users of the Kubeflow Pipeline View web UI version before 930c35f1c543998e60e8d648ce93185c9b5dbe8d.
What type of vulnerability is CVE-2024-9526?
CVE-2024-9526 is a stored cross-site scripting (XSS) vulnerability.
How can attackers exploit CVE-2024-9526?
Attackers can exploit CVE-2024-9526 by inserting malicious HTML or JavaScript code into the description field when creating a new pipeline.