PT-2025-12239 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8613

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240802

Description The issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to view and manipulate chat histories of other users. This allows attackers to access, copy, and delete other users' chat histories.

Recommendations For gaizhenbiao/chuanhuchatgpt version 20240802, consider implementing proper session data handling and access control mechanisms to prevent unauthorized access to chat histories. As a temporary workaround, restrict access to sensitive chat history data until a patch is available.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2024-8613

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 5

• 🔥 https://huntr.com/bounties/76258774-b011-4044-9c3d-c2609b1cbd29 · Exploit
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/526c615c437377ee9c71f866fd0f19011910f705 · Patch
• https://osv.dev/vulnerability/CVE-2024-8613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8613 · Security Note
• https://twitter.com/CVEnew/status/1902670958948966642 · Twitter Post