PT-2024-31478 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-06-04 · Updated 2025-10-15 · CVE-2024-4520

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240410

Description An improper access control issue exists, allowing any user on the server to access the chat history of other users without interaction. This could lead to data breaches, exposing sensitive details, financial data, or confidential conversations, and facilitate identity theft, manipulation, or fraud due to insufficient access control mechanisms in handling chat history data.

Recommendations For version 20240410, consider restricting access to chat history data until a patch is available. As a temporary workaround, disabling the feature that allows access to chat history may minimize the risk of exploitation. Additionally, reviewing and enhancing access control mechanisms in the application's handling of chat history data is recommended.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-4520

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 8

• 🔥 https://huntr.com/bounties/0dd2da9f-998d-45aa-a646-97391f524000 · Exploit
• https://osv.dev/vulnerability/CVE-2024-4520 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4520 · Security Note
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b · Note
• https://t.me/cvenotify/82834 · Telegram Post
• https://t.me/cveNotify/138732 · Telegram Post
• https://t.me/cvenotify/82069 · Telegram Post
• https://t.me/cvenotify/82001 · Telegram Post