Back

CVE-2024-3403

May 16, 2024, 1:03 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

imartinez/privategpt

  • 0.2.0

privategpt

  • 0.2.0

Source

security@huntr.dev

Tags

CWE-22
security@huntr.dev
2024-05-16
CVE-2024-3403

CVE-2024-3403 details

Published : May 16, 2024, 9:15 a.m.
Last Modified : May 16, 2024, 1:03 p.m.

Description

imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.

CVSS Score

1 2 3 4 5 6 7.5 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score

7.5

Exploitability Score

Impact Score

Base Severity

HIGH

Vector String : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

URL Source
https://huntr.com/bounties/7431d1dd-f014-4d4f-acb6-f97369ef3688 security@huntr.dev
This website uses the NVD API, but is not approved or certified by it.