CVE-2024-6255

July 31, 2024, 12:57 p.m.

CVSS Score

8.2 / 10

Product(s) Impacted

gaizhenbiao/chuanhuchatgpt

20240410

Description

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

Weaknesses

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

CWE ID: 73

Date

Published: July 31, 2024, 1:15 a.m.

Last Modified: July 31, 2024, 12:57 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@huntr.dev

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

Base Score

8.2

Exploitability Score

3.9

Impact Score

4.2

Base Severity