Lucene search

K
cvelistGitHub_MCVELIST:CVE-2024-31224
HistoryApr 08, 2024 - 3:24 p.m.

CVE-2024-31224 GPT Academic: Pickle deserializing cookies may pose RCE risk

2024-04-0815:24:01
CWE-502
GitHub_M
www.cve.org
gpt academic
remote code execution
vulnerability
deserialization
patched version

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.

CNA Affected

[
  {
    "vendor": "binary-husky",
    "product": "gpt_academic",
    "versions": [
      {
        "version": ">= 3.64, < 3.74",
        "status": "affected"
      }
    ]
  }
]

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

Related for CVELIST:CVE-2024-31224