Modelscope Agentscope CORS Vulnerability in v0.0.4 Allowing Unauthorized API Access

A Cross-Origin Resource Sharing (CORS) vulnerability has been identified in Modelscope Agentscope version v0.0.4. The CORS configuration on the Agentscope server fails to adequately restrict access to trusted origins, permitting any external domain to send requests to the API. This oversight could result in unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the system's integrity and confidentiality.

Impact

Exploitation of this vulnerability could lead to unauthorized access to data, information disclosure, and potential further exploitation of the system, compromising its integrity and confidentiality.