What is GHSA-38r9-3j52-h92v?

GHSA-38r9-3j52-h92v is a security advisory published by GitHub Security Advisories with High severity. Aim vulnerable to Cross-Site Request Forgery

Which CVE IDs does GHSA-38r9-3j52-h92v cover?

GHSA-38r9-3j52-h92v covers the following CVE IDs: CVE-2024-7760. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-38r9-3j52-h92v?

GHSA-38r9-3j52-h92v has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

Which products are affected by GHSA-38r9-3j52-h92v?

GHSA-38r9-3j52-h92v affects 1 product, including: pip/aim:\u003c= 3.22.0.

GHSA-38r9-3j52-h92vHighCVSS 7.4

Aim vulnerable to Cross-Site Request Forgery

Vendor

GitHub Security Advisories

Published

March 20, 2025

Last Modified

July 22, 2025

🔗 CVE IDs covered (1)

CVE-2024-7760 →

📋 Description

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly permissive CORS settings, allowing cross-origin requests from all origins. This enables CSRF attacks on all endpoints of the tracking server, which can be chained with other existing vulnerabilities such as remote code execution, denial of service, and arbitrary file read/write.

🎯 Affected products1

pip/aim:<= 3.22.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2024-7760
https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229
https://github.com/advisories/GHSA-38r9-3j52-h92v