PT-2025-12289 · Answer · Answer

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9617

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94

Description The issue allows an attacker to view any files due to a lack of verification of whether the attacker is the creator of the file. This can be exploited by directly calling the GET /api/chat/file/{file id} interface to view any user's file. The file id variable is used in this process.

Recommendations For danswer-ai/danswer version 0.3.94, consider restricting access to the GET /api/chat/file/{file id} interface until a patch is available, or implement a verification mechanism to ensure only the file creator can access the file.

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2024-9617

Affected Products

Answer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-9617 · Security Note
• https://twitter.com/CVEnew/status/1902671118885875974 · Twitter Post
• https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146 · Note