CVE-2024-8143
Oct. 31, 2024, 4:23 p.m.
4.3
Medium
Description
In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to private chat histories. This vulnerability can be exploited to read any user's private chat history.
Product(s) Impacted
| Vendor | Product | Versions |
|---|---|---|
| Gaizhenbiao |
|
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-1057
Data Access Operations Outside of Expected Data Manager Component
The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.
*CPE(s)
Affected systems and software identified for this CVE.
| Type | Vendor | Product | Version | Update | Edition | Language | Software Edition | Target Software | Target Hardware | Other Information |
|---|---|---|---|---|---|---|---|---|---|---|
| a | gaizhenbiao | chuanhuchatgpt | 2024-06-28 | / | / | / | / | / | / | / |
Tags
CVSS Score
CVSS Data - 3.1
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: LOW
- Scope: UNCHANGED
- Confidentiality Impact: LOW
- Integrity Impact: NONE
- Availability Impact: NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Timeline
Published: Oct. 29, 2024, 1:15 p.m.
Last Modified: Oct. 31, 2024, 4:23 p.m.
Last Modified: Oct. 31, 2024, 4:23 p.m.
Status : Analyzed
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@huntr.dev
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.