CVE-2024-11030: falha de alta gravidade em binary-husky/gpt_academic
SSRF in binary-husky/gpt_academic
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.7%
GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_utils.get_files_from_everything() API without proper sanitization. This allows attackers to exploit the vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
binary-husky · binary-husky/gpt_academicCVEs relacionadas — binary-husky/gpt_academic
No mesmo produto, das mais perigosas para as menos.
CVE-2024-11039HIGHDeserialization of Untrusted Data in binary-husky/gpt_academicEPSS 2.1%CVE-2024-12389HIGHPath Traversal in binary-husky/gpt_academicEPSS 1.7%CVE-2024-12390HIGHRemote Code Execution in binary-husky/gpt_academicEPSS 1.7%CVE-2024-10954HIGHPrompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`EPSS 1.5%CVE-2024-10950HIGHCode Injection in binary-husky/gpt_academicEPSS 1.5%CVE-2024-11037MEDIUMPath Traversal in binary-husky/gpt_academicEPSS 1.1%