CVE-2024-12869: fallo de gravedad media en infiniflow/ragflow
Improper Authentication in infiniflow/ragflow
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.5%
In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed without their consent. This data leakage can facilitate further attacks, such as phishing or spam, and result in loss of trust and potential regulatory issues.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Productos afectados
infiniflow · infiniflow/ragflowCVEs relacionadas — infiniflow/ragflow
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-12433CRITICALRemote Code Execution in infiniflow/ragflowEPSS 1.7%CVE-2024-12450MEDIUMRCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflowEPSS 1.3%CVE-2024-10131HIGHRemote Code Execution in infiniflow/ragflowEPSS 1.1%CVE-2024-12880HIGHPartial Account Takeover due to Insecure Data Querying in infiniflow/ragflowEPSS 0.7%CVE-2024-12779MEDIUMSSRF in infiniflow/ragflowEPSS 0.7%CVE-2024-12870MEDIUMStored Cross-site Scripting (XSS) in infiniflow/ragflowEPSS 0.5%