Create CVE-2024-8537.yaml

[gy741]

Template / PR Information

Hello,

Added CVE-2024-8537

The agentscope application is vulnerable to a path traversal vulnerability in /delete-workflow endpoint that allows any attacker to be able to delete arbitrary files from the filesystem .

• References: https://huntr.com/bounties/eeb8aa4b-e6e5-465c-b0dd-aa97e3b7dc09

Template Validation

I've validated this template locally?

• YES
• NO

Although the issue could not be reproduced due to API issues, the person in charge verified the issue.

[GeorginaReeder]

Thanks so much for your contributions @gy741 !

[ritikchaddha]

Hello @gy741,

I apologize for the delay in my response. After reviewing the template you shared, we have concluded that adding a proof of concept (POC) that deletes the sensitive file is not a good idea. It would be helpful if you could update the POC to make it less intrusive.

Thank you for your understanding.

[ritikchaddha]

Hi @gy741 ,

Due to inactivity, we are closing this pull request. Feel free to raise another pull request with more information.