PT-2024-39677 · Unknown · Kubeflow Pipeline View

Philipp Schneider · Published 2024-11-18 · Updated 2025-07-23 · CVE-2024-9526

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Kubeflow Pipeline View (affected versions not specified)

Description The issue concerns a stored XSS vulnerability in the Kubeflow Pipeline View web UI. This vulnerability allows an attacker to inject malicious HTML code into the description field when creating a new pipeline, as the field does not properly filter HTML tags. This can lead to a stored XSS attack.

Recommendations Upgrade past commit 930c35f1c543998e60e8d648ce93185c9b5dbe8d to resolve the issue. As a temporary workaround, consider restricting the use of HTML tags in the description field to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9526

GO-2024-3278

OPENSUSE-SU-2024:14513-1

Affected Products

Kubeflow Pipeline View

References · 19

• https://github.com/kubeflow/pipelines/pull/10315 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-9526 · Security Note
• https://osv.dev/vulnerability/GO-2024-3278 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14513-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9526 · Vendor Advisory
• https://suse.com/security/cve/CVE-2024-44625 · Note
• https://suse.com/security/cve/CVE-2024-52308 · Note
• https://suse.com/security/cve/CVE-2024-24425 · Note
• https://suse.com/security/cve/CVE-2024-0793 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/CJ6SUNDNOZSHM4PZYYGMBH7233D63JOI · Note
• https://suse.com/security/cve/CVE-2020-8911 · Note
• https://twitter.com/CVEnew/status/1858505456437571824 · Twitter Post
• https://suse.com/security/cve/CVE-2024-24426 · Note
• https://suse.com/security/cve/CVE-2023-0109 · Note
• https://suse.com/security/cve/CVE-2024-52010 · Note