{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-9526", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "state": "PUBLISHED", "assignerShortName": "Google", "dateReserved": "2024-10-04T12:51:28.581Z", "datePublished": "2024-11-18T13:30:21.818Z", "dateUpdated": "2024-11-21T10:24:31.751Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://github.com/kubeflow", "defaultStatus": "unaffected", "product": "Kubeflow Pipeline View", "repo": "https://github.com/kubeflow", "vendor": "Kubeflow", "versions": [{"lessThan": "930c35f1c543998e60e8d648ce93185c9b5dbe8d", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Philipp Schneider"}], "datePublic": "2023-12-18T23:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit&nbsp;930c35f1c543998e60e8d648ce93185c9b5dbe8d</span><br>"}], "value": "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.\u00a0The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit\u00a0930c35f1c543998e60e8d648ce93185c9b5dbe8d"}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "USER", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2024-11-21T10:24:31.751Z"}, "references": [{"url": "https://github.com/kubeflow/pipelines/pull/10315"}], "source": {"discovery": "EXTERNAL"}, "title": "Stored XSS in Kubeflow Pipeline View", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "kubeflow", "product": "kubeflow_w_pipeline_view", "cpes": ["cpe:2.3:a:kubeflow:kubeflow_w_pipeline_view:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "930c35f1c543998e60e8d648ce93185c9b5dbe8d", "versionType": "git"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-18T14:09:39.320505Z", "id": "CVE-2024-9526", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T14:12:09.870Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-9526", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-18T14:09:39.320505Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kubeflow:kubeflow_w_pipeline_view:*:*:*:*:*:*:*:*"], "vendor": "kubeflow", "product": "kubeflow_w_pipeline_view", "versions": [{"status": "affected", "version": "0", "lessThan": "930c35f1c543998e60e8d648ce93185c9b5dbe8d", "versionType": "git"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-18T14:12:04.096Z"}}], "cna": {"title": "Stored XSS in Kubeflow Pipeline View", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Philipp Schneider"}], "impacts": [{"capecId": "CAPEC-243", "descriptions": [{"lang": "en", "value": "CAPEC-243 XSS Targeting HTML Attributes"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "USER", "baseScore": 7.1, "Automatable": "YES", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green", "providerUrgency": "GREEN", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/kubeflow", "vendor": "Kubeflow", "product": "Kubeflow Pipeline View", "versions": [{"status": "affected", "version": "0", "lessThan": "930c35f1c543998e60e8d648ce93185c9b5dbe8d", "versionType": "git"}], "collectionURL": "https://github.com/kubeflow", "defaultStatus": "unaffected"}], "datePublic": "2023-12-18T23:00:00.000Z", "references": [{"url": "https://github.com/kubeflow/pipelines/pull/10315"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.\u00a0The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit\u00a0930c35f1c543998e60e8d648ce93185c9b5dbe8d", "supportingMedia": [{"type": "text/html", "value": "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit&nbsp;930c35f1c543998e60e8d648ce93185c9b5dbe8d</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "14ed7db2-1595-443d-9d34-6215bf890778", "shortName": "Google", "dateUpdated": "2024-11-21T10:24:31.751Z"}}}, "cveMetadata": {"cveId": "CVE-2024-9526", "state": "PUBLISHED", "dateUpdated": "2024-11-21T10:24:31.751Z", "dateReserved": "2024-10-04T12:51:28.581Z", "assignerOrgId": "14ed7db2-1595-443d-9d34-6215bf890778", "datePublished": "2024-11-18T13:30:21.818Z", "assignerShortName": "Google"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kubeflow:pipelines:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9669844-02D9-4BCD-80AE-722750D85F91", "versionEndExcluding": "2023-12-13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI.\u00a0The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We recommend upgrading past commit\u00a0930c35f1c543998e60e8d648ce93185c9b5dbe8d"}, {"lang": "es", "value": "Existe una vulnerabilidad de XSS almacenada en la interfaz web de Kubeflow Pipeline View. La interfaz web de Kubeflow permite crear nuevas canalizaciones. Al crear una nueva canalizaci\u00f3n, es posible agregar una descripci\u00f3n. El campo de descripci\u00f3n permite etiquetas HTML, que no se filtran correctamente. Esto genera un XSS almacenado. Recomendamos actualizar la versi\u00f3n anterior a el commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d"}], "id": "CVE-2024-9526", "lastModified": "2025-07-23T19:42:10.907", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "USER", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "GREEN", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:D/RE:L/U:Green", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "LOW"}, "source": "cve-coordination@google.com", "type": "Secondary"}]}, "published": "2024-11-18T14:15:05.873", "references": [{"source": "cve-coordination@google.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/kubeflow/pipelines/pull/10315"}], "sourceIdentifier": "cve-coordination@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve-coordination@google.com", "type": "Secondary"}]}

{}

{}