PT-2024-25659 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-06-06 · Updated 2025-10-15 · CVE-2024-3404

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240121

Description The issue is due to improper access control mechanisms, allowing an authenticated attacker to bypass intended access restrictions and read the history files of other users. This could lead to unauthorized access to sensitive information. The vulnerability is present in the application's handling of access control for the history path, where no adequate mechanism is in place to prevent an authenticated user from accessing another user's chat history files.

Recommendations For version 20240121, consider disabling access to the history path until a patch is available. Restrict access to the history files to minimize the risk of exploitation. Avoid using the history files in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2024-3404

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 7

• 🔥 https://huntr.com/bounties/ed32fc32-cb8f-4fbd-8209-cc835d279699 · Exploit
• https://osv.dev/vulnerability/CVE-2024-3404 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3404 · Security Note
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b · Note
• https://twitter.com/CVEnew/status/1798789756450689451 · Twitter Post
• https://t.me/cvenotify/95797 · Telegram Post
• https://t.me/cveNotify/138741 · Telegram Post