CVE-2024-10906: falha de alta gravidade em eosphoros-ai/db-gpt
Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Produtos afetados
eosphoros-ai · eosphoros-ai/db-gptCVEs relacionadas — eosphoros-ai/db-gpt
No mesmo produto, das mais perigosas para as menos.
CVE-2024-10902CRITICALArbitrary File Upload with Path Traversal in eosphoros-ai/db-gptEPSS 1.3%CVE-2024-10835CRITICALArbitrary File Write via SQL Injection in eosphoros-ai/db-gptEPSS 1.2%CVE-2024-10901CRITICALArbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gptEPSS 1.1%CVE-2024-10833CRITICALArbitrary File Write in eosphoros-ai/db-gptEPSS 0.8%CVE-2024-10831CRITICALArbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gptEPSS 0.8%CVE-2024-10830HIGHPath Traversal in eosphoros-ai/db-gptEPSS 0.7%