CVE-2024-4321: falha de alta gravidade em gaizhenbiao/chuanhuchatgpt
Local File Inclusion (LFI) in gaizhenbiao/chuanhuchatgpt
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.6%
A Local File Inclusion (LFI) vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker can exploit this vulnerability by intercepting requests and manipulating the 'name' parameter to specify arbitrary file paths. This allows the attacker to read sensitive files on the server, leading to information leakage, including API keys and private information. The issue affects version 20240310 of the application.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
gaizhenbiao · gaizhenbiao/chuanhuchatgptCVEs relacionadas — gaizhenbiao/chuanhuchatgpt
No mesmo produto, das mais perigosas para as menos.
CVE-2024-5982CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 31.3%CVE-2024-6255HIGHPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 13.7%CVE-2024-6036HIGHDenial of Service in gaizhenbiao/chuanhuchatgptEPSS 10.8%CVE-2024-6037HIGHArbitrary Folder Creation in gaizhenbiao/chuanhuchatgptEPSS 10.7%CVE-2024-3234CRITICALPath Traversal in gaizhenbiao/chuanhuchatgptEPSS 3.8%CVE-2024-5124HIGHTiming Attack Vulnerability in gaizhenbiao/chuanhuchatgptEPSS 1.4%