PT-2025-12218 · Answer · Answer

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-8065

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version v1.4.1

Description A Cross-Site Request Forgery (CSRF) issue allows attackers to perform unauthorized actions in the context of the victim's browser, including connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats. The application lacks CSRF protection, making it susceptible to these attacks.

Recommendations For version v1.4.1, consider implementing CSRF protection mechanisms to prevent unauthorized actions. As a temporary workaround, restrict access to sensitive application features to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-8065

Affected Products

Answer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-8065 · Security Note
• https://huntr.com/bounties/61b58753-af36-43fd-b1b9-f3019532dd08 · Note
• https://twitter.com/CVEnew/status/1902968843179577744 · Twitter Post