PT-2024-28041 · Unknown · Imartinez/Privategpt

Published 2024-05-16 · Updated 2025-05-19 · CVE-2024-3851

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions imartinez/privategpt (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists due to improper validation of file uploads. Attackers can exploit this by uploading malicious HTML files containing JavaScript payloads. When accessed, these files are executed in the context of the victim's session, potentially leading to the execution of arbitrary JavaScript code in the user's browser session. This could result in phishing attacks or other malicious actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-3851

Affected Products

Imartinez/Privategpt

References · 4

• 🔥 https://huntr.com/bounties/cae1a492-4e09-4d56-8e11-17703bdfe653 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3851 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3851 · Vendor Advisory
• https://t.me/cvenotify/122948 · Telegram Post