CVE-2024-8501 - CVE House
Back to Database
Status published High CVE-2024-8501

Arbitrary File Download in modelscope/agentscope

Vulnerability Description

An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpc_agent's host by exploiting the download_file method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-8501

Credits & Attribution

No credits recorded in the NVD database.

References

More from modelscope

View All →
CVE-2024-8556
Stored XSS in modelscope/agentscope
Medium 6.1
CVE-2024-8551
Path Traversal in modelscope/agentscope
Critical 9.1
CVE-2024-8550
Local File Inclusion (LFI) in modelscope/agentscope
High 7.5
CVE-2024-8537
Path Traversal in modelscope/agentscope
Critical 9.1
CVE-2024-8524
Directory Traversal in modelscope/agentscope
High 7.5

Affected Vendor

Affected Software

modelscope/agentscope
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-36

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.