CVE-2024-2217

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-2217
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2217.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-2217
Aliases
Published
2024-04-10T17:08:02.787Z
Modified
2026-07-15T01:48:50.470626908Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Improper Access Control in gaizhenbiao/chuanhuchatgpt
Details

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (openai_api_key, google_palm_api_key, xmchat_api_key, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the config.json file, which does not properly restrict access based on user authentication.

Database specific 
{
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2217.json"
}
References

Affected packages

Git / github.com/gaizhenbiao/chuanhuchatgpt

Affected ranges

Type
GIT
Repo
https://github.com/gaizhenbiao/chuanhuchatgpt
Events
Introduced
4cadbd181af14070971e0b2506018783b74958df
Fixed
c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7d
Database specific 
{
    "cpe": "cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:20240121:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "20240121"
        },
        {
            "last_affected": "20240121"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

Other
20240121
20240305

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2217.json"