CVE-2024-38514

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-38514

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-38514.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-38514

Aliases

GHSA-gph5-rx77-3pjg

Published

2024-06-28T18:11:02.964Z

Modified

2025-12-05T05:08:40.573643Z

Severity

7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

NextChat Server-Side Request Forgery (SSRF)

Details

NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the endpoint GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38514.json"
}

References

Affected packages

Git / github.com/chatgptnextweb/chatgpt-next-web

Affected ranges

Type

GIT

Repo

https://github.com/chatgptnextweb/chatgpt-next-web

Events

Introduced

Fixed

b972a0d0817e612fe2a1cba398c338bcec7573e6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.12.4"
        }
    ]
}

Affected versions

Other

app-vundefined

v1.*

v1.0

v1.1

v1.2

v1.3

v1.4

v1.5

v1.6

v1.7

v1.7.1

v1.7.2

v1.8

v1.9

v1.9.1

v1.9.2

v1.9.3

v1.9.4

v1.9.5

v1.9.6

v1.9.7

v1.9.8

v1.9.9

v2.*

v2.0.1

v2.1

v2.10.1

v2.10.2

v2.10.3

v2.11.2

v2.11.3

v2.12.1

v2.12.2

v2.12.3

v2.2

v2.3

v2.4

v2.5

v2.6

v2.7

v2.8

v2.8.1

v2.8.2

v2.8.3

v2.8.4

v2.8.5

v2.8.6

v2.8.7

v2.8.8

v2.8.9

v2.9.0

v2.9.1

v2.9.10

v2.9.11

v2.9.12

v2.9.13

v2.9.2

v2.9.3

v2.9.4

v2.9.5

v2.9.6

v2.9.7

v2.9.8

v2.9.9

Git / github.com/chatgptnextweb/nextchat