CVE-2024-9107mediumCWE-79

CVE-2024-9107: fallo de gravedad media en gaizhenbiao/chuanhuchatgpt

Stored XSS in gaizhenbiao/chuanhuchatgpt

Publicada el

Seguir esta CVE+ Monitorear gaizhenbiao/chuanhuchatgpt+ Monitorear chuanhuchatgpt

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.8epss 0.6%
A stored cross-site scripting (XSS) vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code blocks correctly, allowing an attacker to inject malicious scripts. This can lead to the execution of arbitrary JavaScript code in the context of the user's browser, potentially leading to identity theft or other malicious actions.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Productos afectados
gaizhenbiao · gaizhenbiao/chuanhuchatgpt
CVEs relacionadas — gaizhenbiao/chuanhuchatgpt

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-5982CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 31.3%CVE-2024-6255HIGHPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 13.7%CVE-2024-6036HIGHDenial of Service in gaizhenbiao/chuanhuchatgptEPSS 10.8%CVE-2024-6037HIGHArbitrary Folder Creation in gaizhenbiao/chuanhuchatgptEPSS 10.7%CVE-2024-3234CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 3.8%CVE-2024-5124HIGHTiming Attack Vulnerability in gaizhenbiao/chuanhuchatgptEPSS 1.4%