PT-2025-12108 · Feast · Feast

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-11602

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions feast-dev/feast version 0.40.0

Description A Cross-Origin Resource Sharing (CORS) issue exists, where the CORS configuration on the agentscope server does not properly restrict access to only trusted origins. This allows any external domain to make requests to the API, potentially bypassing intended security controls and exposing sensitive information.

Recommendations For version 0.40.0, consider restricting access to the agentscope server API by properly configuring CORS to only allow requests from trusted origins until a patch is available.

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-11602

GHSA-WXPC-2674-RXVW

Affected Products

Feast

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-11602 · Security Note
• https://osv.dev/vulnerability/GHSA-wxpc-2674-rxvw · Vendor Advisory
• https://github.com/feast-dev/feast · Note
• https://huntr.com/bounties/7b24ecbe-0af7-4125-ab56-bce09786042e · Note
• https://twitter.com/CVEnew/status/1902671056546009553 · Twitter Post