CVE-2024-5823

A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gaizhenbiao/chuanhuchatgpt/commit/720c23d755a4a955dcb0a54e8c200a2247a27f8b	Patch
https://huntr.com/bounties/ca361701-7d68-4df6-8da0-caad4b85b9ae	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-29 13:15

Updated : 2024-10-31 18:05

NVD link : CVE-2024-5823

Mitre link : CVE-2024-5823

CVE.ORG link : CVE-2024-5823

JSON object : View

Products Affected

gaizhenbiao

chuanhuchatgpt

CWE

CWE-73

External Control of File Name or Path

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

{"id": "CVE-2024-5823", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2024-10-29T13:15:07.380", "references": [{"url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/720c23d755a4a955dcb0a54e8c200a2247a27f8b", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/ca361701-7d68-4df6-8da0-caad4b85b9ae", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-73"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-610"}]}], "descriptions": [{"lang": "en", "value": "A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions <= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation."}, {"lang": "es", "value": "Existe una vulnerabilidad de sobrescritura de archivos en las versiones de gaizhenbiao/chuanhuchatgpt <= 20240410. Esta vulnerabilidad permite a un atacante obtener acceso no autorizado para sobrescribir archivos de configuraci\u00f3n cr\u00edticos dentro del sistema. La explotaci\u00f3n de esta vulnerabilidad puede provocar cambios no autorizados en el comportamiento del sistema o en la configuraci\u00f3n de seguridad. Adem\u00e1s, la manipulaci\u00f3n de estos archivos de configuraci\u00f3n puede provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS), lo que interrumpe el funcionamiento normal del sistema."}], "lastModified": "2024-10-31T18:05:00.637", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1491457-1C35-46E2-B227-86AD7E60215F", "versionEndIncluding": "2024-04-10"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}