PT-2025-12209 · Netease Youdao · Qanything

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8027

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions netease-youdao/QAnything versions prior to the fixed version

Description A stored Cross-Site Scripting (XSS) issue exists, allowing attackers to upload malicious knowledge files to the knowledge base. These files can trigger XSS attacks during user chats.

Recommendations For versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider restricting the upload of knowledge files to trusted sources until the patch is applied. Avoid using the vulnerable knowledge base feature until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8027

Affected Products

Qanything

References · 4

• 🔥 https://huntr.com/bounties/cf75f024-3d64-416d-adfe-c4255d7c3f34 · Exploit
• https://osv.dev/vulnerability/CVE-2024-8027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8027 · Security Note
• https://twitter.com/CVEnew/status/1902671108308132309 · Twitter Post