PT-2024-15235 · Unknown · Chanzhaoyu Chatgpt-Web

Mido0X0X · Published 2024-01-07 · Updated 2024-05-17 · CVE-2023-7215

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chanzhaoyu chatgpt-web version 2.11.1

Description A problematic issue has been found in the software, affecting some unknown processing. The manipulation of the argument Description with the input <image src onerror=prompt(document.domain)> leads to cross-site scripting. The attack may be initiated remotely.

Recommendations For Chanzhaoyu chatgpt-web version 2.11.1, consider disabling the Description argument to prevent cross-site scripting attacks until a patch is available. Restrict access to the affected processing to minimize the risk of exploitation. Avoid using the Description argument with untrusted input in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-7215

Affected Products

Chanzhaoyu Chatgpt-Web

References · 7

• 🔥 https://github.com/Chanzhaoyu/chatgpt-web/issues/2001 · Exploit
• https://osv.dev/vulnerability/CVE-2023-7215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-7215 · Security Note
• https://twitter.com/CVEnew/status/1744178868150243564 · Twitter Post
• https://vuldb.com/?id.249779 · Note
• https://twitter.com/VulmonFeeds/status/1744248848808099875 · Twitter Post
• https://vuldb.com/?ctiid.249779 · Note