CVE-2024-8027 — Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything

CVE-2024-8027

Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything PUBLISHED

Description (CNA)

A stored Cross-Site Scripting (XSS) vulnerability exists in netease-youdao/QAnything. Attackers can upload malicious knowledge files to the knowledge base, which can trigger XSS attacks during user chats. This vulnerability affects all versions prior to the fix.

Affected (CNA)

Vendor / product	Versions
netease-youdao / netease-youdao/qanything	affected unspecified through latest

CWE

CWE-79

References

https://huntr.com/bounties/cf75f024-3d64-416d-adfe-c4255d7c3f34

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.