CVE-2024-10906

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-10906

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10906.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-10906

Aliases

Published

2025-03-20T10:10:05.603Z

Modified

2026-07-08T07:47:10.659474996Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L CVSS Calculator

Summary

Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt

Details

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgpt_server uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to * for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10906.json",
    "cwe_ids": [
        "CWE-352"
    ],
    "cna_assigner": "@huntr_ai"
}

References

Affected packages

Git / github.com/eosphoros-ai/db-gpt

Affected ranges

Type

GIT

Repo

https://github.com/eosphoros-ai/db-gpt

Events

Introduced

b34295562924046c229f0fd424ac3c7b54b7ecc8

Last affected

b34295562924046c229f0fd424ac3c7b54b7ecc8

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.6.0"
        },
        {
            "last_affected": "0.6.0"
        }
    ]
}

Affected versions

0.*

0.6.0

v0.*

v0.6.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10906.json"