PT-2023-24612 · Unknown · Gpt Academic

Eggdkk · Publicado 2023-05-31 · Atualizado 2025-03-07 · CVE-2023-33979

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gpt academic versions 3.37 and prior

Description A vulnerability was found in the Configuration File Handler component of gpt academic, affecting the processing of certain files. The manipulation of the file argument leads to information disclosure, allowing sensitive information files in working directories to be read through the "/file" route. This issue affects users who configure the project via config.py, config private.py, or Dockerfile files.

Recommendations For gpt academic versions 3.37 and prior, update to a version that includes the patch available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a temporary workaround, consider using environment variables instead of config*.py files to configure the project. Alternatively, use docker-compose installation to configure the project, avoiding the use of sensitive files in the working directories.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-33979

GHSA-PG65-P24M-WF5G

Produtos afetados

Gpt Academic

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33979.json · Exploit
• https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 · Correção
• https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g · Aviso do Fabricante
• https://t.me/cvenotify/51498 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33979 · Aviso do Fabricante
• https://t.me/cvenotify/113830 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33979 · Nota de Segurança