Lucene search

@huntr_aiCVELIST:CVE-2024-3402

HistoryJun 06, 2024 - 6:24 p.m.

CVE-2024-3402 Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt

2024-06-0618:24:03

CWE-79

@huntr_ai

www.cve.org

cross-site scripting

model output data

javascript code

browser execution

vulnerability

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.2%

JSON

A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user’s browser. This vulnerability can lead to the execution of arbitrary JavaScript code in the context of other users’ browsers, potentially resulting in the hijacking of victims’ browsers.

CNA Affected

[
  {
    "vendor": "gaizhenbiao",
    "product": "gaizhenbiao/chuanhuchatgpt",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

References

huntr.com/bounties/389570c4-0bf2-4bc3-84f5-2e7afdba8ed1

6.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVELIST:CVE-2024-3402