CVE-2024-10906

In version 0.6.0 of eosphoros-ai/db-gpt, the "uvicorn" app created by "dbgptserver" uses an overly permissive instance of "CORSMiddleware" which sets the "Access-Control-Allow-Origin" to "" for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site...

CVE-2024-10906: Cross-Site Request Forgery (CSRF)

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...