PT-2024-37185 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Gaizhenbiao · Published 2024-10-29 · Updated 2024-10-31 · CVE-2024-5823

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt versions <= 20240410

Description: A file overwrite issue exists, allowing unauthorized access to overwrite critical configuration files. This can lead to unauthorized changes in system behavior or security settings. Tampering with these files can also result in a denial of service (DoS) condition, disrupting normal system operation.

Recommendations: For gaizhenbiao/chuanhuchatgpt versions <= 20240410, consider restricting access to critical configuration files to prevent unauthorized overwrites until a patch is available. As a temporary workaround, monitor system behavior and security settings closely for any unauthorized changes.

Exploit

Fix

Weakness Enumeration

CWE-610

CWE-73

Related Identifiers

CVE-2024-5823

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 5

• 🔥 https://huntr.com/bounties/ca361701-7d68-4df6-8da0-caad4b85b9ae · Exploit
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/720c23d755a4a955dcb0a54e8c200a2247a27f8b · Patch
• https://osv.dev/vulnerability/CVE-2024-5823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5823 · Security Note
• https://t.me/cvedetector/9327 · Telegram Post