CVE-2024-12580mediumCWE-117

CVE-2024-12580: medium-severity vulnerability in danny-avila/librechat

Logs Debug Injection in danny-avila/librechat

Published

Follow this CVE+ Monitor danny-avila/librechat

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.3epss 0.5%
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
danny-avila · danny-avila/librechat
Related CVEs — danny-avila/librechat

In the same product, most dangerous first.

CVE-2024-11170HIGHPath Traversal in danny-avila/librechatEPSS 1.8%CVE-2024-10361HIGHArbitrary File Deletion via Path Traversal in danny-avila/librechatEPSS 1.0%CVE-2024-11172HIGHDenial of Service in danny-avila/librechatEPSS 0.9%CVE-2024-11169HIGHUnhandled Exception Leading to Server Crash in danny-avila/librechatEPSS 0.9%CVE-2024-11173MEDIUMUnhandled Exception in danny-avila/librechatEPSS 0.9%CVE-2024-11167CRITICALImproper Access Control in danny-avila/librechatEPSS 0.6%