PT-2025-12078 · Fastchat · Fastchat

Publicado 2025-03-20 · Atualizado 2025-03-21 · CVE-2024-10908

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fastchat version 0.2.36

Description An open redirect issue allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.

Recommendations For version 0.2.36, update to a newer version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to URLs that could be used for redirecting users to minimize the risk of exploitation. Avoid using URLs that could be manipulated by an attacker until the issue is resolved.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2024-10908

GHSA-77CJ-RV5X-V6R2

Produtos afetados

Fastchat

Referências · 6

• 🔥 https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2 · Exploit
• https://github.com/lm-sys/FastChat · Nota
• https://osv.dev/vulnerability/GHSA-77cj-rv5x-v6r2 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-10908 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-10908 · Nota de Segurança
• https://twitter.com/CVEnew/status/1902968853568819327 · Publicação no Twitter