What is CVE-2024-5186?

CVE-2024-5186 is a high-severity vulnerability in Imartinez Imartinez/privategpt, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.2/10. Published 2024-06-06.

How severe is CVE-2024-5186?

High severity. CVSS v3 base score is 7.2 out of 10.

Is CVE-2024-5186 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

SSRF in Imartinez Imartinez/privategpt

CVE-2024-5186

A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically, by manipulating the 'path' parameter in a file upload request, an attacker can cause the application to make arbitrary requests to internal services, including the AWS metadata endpoint. This issue could lead to the exposure of internal servers and sensitive data.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.003 (26.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Imartinez Imartinez/privategpt — versions unspecified
Pribai Privategpt — versions 0.5.0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

Public proof-of-concept exploits

References

security@huntr.dev (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2024-5186?: CVE-2024-5186 is a high-severity vulnerability in Imartinez Imartinez/privategpt, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.2/10. Published 2024-06-06.
How severe is CVE-2024-5186?: High severity. CVSS v3 base score is 7.2 out of 10.
Is CVE-2024-5186 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.