CVE-2024-11602 HIGH

CVE-2024-11602: CORS Vulnerability in feast-dev/feast

Vendor Feast-Dev
Product feast-dev/feast
Weakness CWE-346 · Origin validation
Published March 20, 2025
Last update March 20, 2025

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

A Cross-Origin Resource Sharing (CORS) vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security controls and potentially expose sensitive information.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated