PT-2025-11370 · Unknown · Springboot-Openai-Chatgpt

Aibot88 · Published 2025-03-15 · Updated 2025-10-21 · CVE-2025-2334

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: springboot-openai-chatgpt version e84f6f5

Description: A problematic issue has been discovered, affecting the deleteChat function of the Chat History Handler component, specifically in the /api/mjkj-chat/chat/ai/delete/chat API endpoint. The manipulation of the chatListId argument leads to improper access controls, allowing for remote attacks. The exploit has been publicly disclosed.

Recommendations: For version e84f6f5, consider disabling the deleteChat function until a patch is available to prevent improper access controls. Restrict access to the /api/mjkj-chat/chat/ai/delete/chat API endpoint to minimize the risk of exploitation. Avoid using the chatListId argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2025-2334

Affected Products

Springboot-Openai-Chatgpt

References · 10

• 🔥 https://cnblogs.com/aibot/p/18732182 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-2334 · Security Note
• https://osv.dev/vulnerability/CVE-2025-2334 · Vendor Advisory
• https://t.me/cveNotify/139623 · Telegram Post
• https://t.me/cvetracker/19209 · Telegram Post
• https://vuldb.com/?id.299799 · Note
• https://vuldb.com/?submit.505688 · Note
• https://twitter.com/CVEnew/status/1901049068480049465 · Twitter Post
• https://t.me/cvedetector/20374 · Telegram Post
• https://vuldb.com/?ctiid.299799 · Note