PT-2025-12213 · Unknown · Danswer-Ai/Danswer

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8057

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.4.1

Description A vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to admin users. This can lead to excessive resource consumption, potentially resulting in a Denial of Service (DoS) and other significant issues, impacting the system's stability and security.

Recommendations For version 0.4.1, consider restricting the ability of basic users to create credentials and link them to existing connectors to prevent excessive resource consumption and potential Denial of Service (DoS) attacks. As a temporary workaround, restrict access to the connector linking feature for basic users until a patch is available.

Fix

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-284

CWE-306

Related Identifiers

CVE-2024-8057

Affected Products

Danswer-Ai/Danswer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-8057 · Security Note
• https://huntr.com/bounties/b5991b98-a721-4acd-8ef2-980e15682913 · Note
• https://twitter.com/CVEnew/status/1902671069976076556 · Twitter Post