PT-2023-24612 · Unknown · Gpt Academic

Eggdkk · Published 2023-05-31 · Updated 2025-03-07 · CVE-2023-33979

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gpt academic versions 3.37 and prior

Description A vulnerability was found in the Configuration File Handler component of gpt academic, affecting the processing of certain files. The manipulation of the file argument leads to information disclosure, allowing sensitive information files in working directories to be read through the "/file" route. This issue affects users who configure the project via config.py, config private.py, or Dockerfile files.

Recommendations For gpt academic versions 3.37 and prior, update to a version that includes the patch available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a temporary workaround, consider using environment variables instead of config*.py files to configure the project. Alternatively, use docker-compose installation to configure the project, avoiding the use of sensitive files in the working directories.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-33979

GHSA-PG65-P24M-WF5G

Affected Products

Gpt Academic

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33979.json · Exploit
• https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 · Patch
• https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33979 · Security Note
• https://t.me/cvenotify/51498 · Telegram Post
• https://t.me/cvenotify/113830 · Telegram Post