漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
CSRF due to overly permissive CORS headers in netease-youdao/qanything
Vulnerability Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.
CVSS Information
N/A
Vulnerability Type
跨站请求伪造(CSRF)
Vulnerability Title
NetEase QAnything 安全漏洞
Vulnerability Description
NetEase QAnything是中国网易（NetEase）公司的致力于支持任意格式文件或数据库的本地知识库问答系统，可断网安装使用。 NetEase QAnything存在安全漏洞，该漏洞源于后端API的跨站请求伪造，由于CORS头配置过于宽松，允许所有跨域调用。
CVSS Information
N/A
Vulnerability Type
N/A