Lucene search
This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.WEB_APPLICATION_SCANNING_114326HistoryJun 24, 2024 - 12:00 a.m.
NextChat < 2.12.4 Server-Side Request Forgery
2024-06-2400:00:00
This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
1
nextchat server-side request forgery scanner
7.3 High
AI Score
Confidence
High
NextChat (formerly ChatGPT-Next-Web) versions prior to 2.12.4 are vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting attacks, allowing remote and unauthenticated attacker to make the vulnerable instance issue arbitrary requests on both external or internal assets through the ‘/api/webdav’ endpoint or to execute JavaScript in the application users browsers context.
No source data7.3 High
AI Score
Confidence
High