What is CVE-2024-6255?

CVE-2024-6255 is a high-severity vulnerability in Gaizhenbiao Chuanhuchatgpt, classified under Path Traversal. CVSS score: 8.2/10. Published 2024-07-31.

How severe is CVE-2024-6255?

High severity. CVSS v3 base score is 8.2 out of 10.

Is CVE-2024-6255 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Gaizhenbiao Chuanhuchatgpt

CVE-2024-6255

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabling directory traversal attacks. An attacker can exploit this vulnerability to disrupt the functioning of the system, manipulate settings, or potentially cause data loss or corruption.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.131 (96.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H.

Affected products

Gaizhenbiao Chuanhuchatgpt — versions 20240410
Gaizhenbiao Gaizhenbiao/chuanhuchatgpt — versions unspecified

Weakness classification (CWE)

CWE-22 — Path Traversal

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@huntr.dev (Technical Description, Exploit, Issue Tracking)

Frequently asked questions

What is CVE-2024-6255?: CVE-2024-6255 is a high-severity vulnerability in Gaizhenbiao Chuanhuchatgpt, classified under Path Traversal. CVSS score: 8.2/10. Published 2024-07-31.
How severe is CVE-2024-6255?: High severity. CVSS v3 base score is 8.2 out of 10.
Is CVE-2024-6255 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.