PT-2025-12168 · Vanna · Vanna

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-6841

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions vanna-ai/vanna (affected versions not specified)

Description A Cross-Site Request Forgery (CSRF) issue exists in the vanna-ai/vanna repository. Two endpoints in the built-in web app, which provide SQL functionality, are implemented as simple GET requests, making them vulnerable to CSRF attacks. This allows an attacker to execute arbitrary SQL commands via CSRF without the target intending to expose the web app to the network or other users. The impact is limited to data alteration or deletion, as the attacker cannot read the results of the query.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-6841

Affected Products

Vanna

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-6841 · Security Note
• https://twitter.com/CVEnew/status/1902671142634029230 · Twitter Post
• https://huntr.com/bounties/7c6cf388-6399-4e37-99f6-3f052eb1136e · Note