CSRF in Danswer-Ai Danswer-Ai/danswer
CVE-2024-8065
A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.002 (9.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.
Affected products
- Danswer-ai Danswer-ai/danswer — versions unspecified
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-8065?
- CVE-2024-8065 is a high-severity vulnerability in Danswer-Ai Danswer-Ai/danswer, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.1/10. Published 2025-03-20.
- How severe is CVE-2024-8065?
- High severity. CVSS v3 base score is 8.1 out of 10.