CVE-2024-8143

Oct. 29, 2024, 2:34 p.m.

CVSS Score

6.5 / 10

Product(s) Impacted

gaizhenbiao/chuanhuchatgpt

  • latest version (20240628)

Description

In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to private chat histories. This vulnerability can be exploited to read any user's private chat history.

Weaknesses

CWE-1057
Data Access Operations Outside of Expected Data Manager Component

The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.

CWE ID: 1057

Date

Published: Oct. 29, 2024, 1:15 p.m.

Last Modified: Oct. 29, 2024, 2:34 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@huntr.dev

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score
6.5
Exploitability Score
2.8
Impact Score
3.6
Base Severity
MEDIUM
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References