CVE-2024-8487

CVE-2024-8487 is a critical Cross-Origin Resource Sharing (CORS) vulnerability in modelscope/agentscope version v0.0.4, where the server's CORS configuration permits requests from any external domain. This allows for unauthorized data access, information disclosure, and potential system compromise, rated with a CVSS score of 9.8 (CRITICAL). The vulnerability is easily exploitable over the network with low attack complexity, posing a high risk to confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions.