PT-2025-12151 · Unknown · Infiniflow/Ragflow

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-12869

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions infiniflow/ragflow version v0.12.0

Description The issue is related to improper authentication, allowing a user to view another user's invite list. This can lead to a privacy breach, exposing personal or private information such as email addresses or usernames without consent. The exposed data can facilitate further attacks like phishing or spam, resulting in loss of trust and potential regulatory issues.

Recommendations For infiniflow/ragflow version v0.12.0, update to a version that fixes the improper authentication issue to prevent unauthorized access to invite lists. As a temporary workaround, consider restricting access to invite lists until a patch is available.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2024-12869

Affected Products

Infiniflow/Ragflow

References · 4

• 🔥 https://huntr.com/bounties/768b1a56-1e79-416a-8445-65953568b04a · Exploit
• https://osv.dev/vulnerability/CVE-2024-12869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12869 · Security Note
• https://twitter.com/CVEnew/status/1902670991412596776 · Twitter Post