CVE-2024-11167criticalCWE-639

CVE-2024-11167: falha crítica em danny-avila/librechat

Improper Access Control in danny-avila/librechat

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar danny-avila/librechat

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.6%
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
danny-avila · danny-avila/librechat
CVEs relacionadas — danny-avila/librechat

No mesmo produto, das mais perigosas para as menos.

CVE-2024-11170HIGHPath Traversal in danny-avila/librechatEPSS 1.8%CVE-2024-10361HIGHArbitrary File Deletion via Path Traversal in danny-avila/librechatEPSS 1.0%CVE-2024-11172HIGHDenial of Service in danny-avila/librechatEPSS 0.9%CVE-2024-11169HIGHUnhandled Exception Leading to Server Crash in danny-avila/librechatEPSS 0.9%CVE-2024-11173MEDIUMUnhandled Exception in danny-avila/librechatEPSS 0.9%CVE-2024-11171HIGHImproper Input Validation in danny-avila/librechatEPSS 0.5%