CVE-2024-3402

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-3402

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3402.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-3402

Published

2024-06-06T18:24:03.274Z

Modified

2026-07-15T01:48:52.623401952Z

Severity

6.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N CVSS Calculator

Summary

Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt

Details

A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user's browser. This vulnerability can lead to the execution of arbitrary JavaScript code in the context of other users' browsers, potentially resulting in the hijacking of victims' browsers.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3402.json",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/gaizhenbiao/chuanhuchatgpt

Affected ranges

Type

GIT

Repo

https://github.com/gaizhenbiao/chuanhuchatgpt

Events

Introduced

Fixed

952fc8c3cbacead858311747cddd4bedcb4721d7

Database specific

{
    "cpe": "cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "20240918"
        }
    ]
}

Affected versions

Other

20230303

20230305

20230317

20230320

20230323

20230327

20230330

20230409

20230413

20230417

20230422

20230427

20230502

20230507

20230513

20230526

20230601

20230614

20230619

20230628

20230709

20230719

20230728

20230809

20230820

20230830

20230911

20230916

20230926

20231006

20231020

20231110

20231215

20231223

20240121

20240305

20240310

20240410

20240628

20240802

20240914

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3402.json"