What’s Vulnerable › Vulnerabilities

CVE-2024-8024: CORS Misconfiguration in netease-youdao/qanything

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-346

Description

A CORS misconfiguration vulnerability exists in netease-youdao/qanything version 1.4.1. This vulnerability allows an attacker to bypass the Same-Origin Policy, potentially leading to sensitive information exposure. Properly implementing a restrictive CORS policy is crucial to prevent such security issues.

Affected products

• netease-youdao/qanything: 1.4.1

References

• https://huntr.com/bounties/bda53fab-88aa-4e03-8d9d-4cf50a98ffc7

Get alerted when CVE-2024-8024 or the next vulnerability affects your stack