CVE-2024-3404: medium-severity vulnerability in gaizhenbiao/chuanhuchatgpt
Improper Access Control in gaizhenbiao/chuanhuchatgpt
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw allows an authenticated attacker to bypass intended access restrictions and read the `history` files of other users, potentially leading to unauthorized access to sensitive information. The vulnerability is present in the application's handling of access control for the `history` path, where no adequate mechanism is in place to prevent an authenticated user from accessing another user's chat history files. This issue poses a significant risk as it could allow attackers to obtain sensitive information from the chat history of other users.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
gaizhenbiao · gaizhenbiao/chuanhuchatgptRelated CVEs — gaizhenbiao/chuanhuchatgpt
In the same product, most dangerous first.
CVE-2024-5982CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 31.3%CVE-2024-6255HIGHPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 13.7%CVE-2024-6036HIGHDenial of Service in gaizhenbiao/chuanhuchatgptEPSS 10.8%CVE-2024-6037HIGHArbitrary Folder Creation in gaizhenbiao/chuanhuchatgptEPSS 10.7%CVE-2024-3234CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 3.8%CVE-2024-5124HIGHTiming Attack Vulnerability in gaizhenbiao/chuanhuchatgptEPSS 1.4%