Vulnerability in Gaizhenbiao Chuanhuchatgpt
CVE-2024-9216
An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure source like a cookie. This allows an attacker to pass another user's username to the get_model function, thereby gaining unauthorized access to that user's chat history.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.006 (49.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Gaizhenbiao Chuanhuchatgpt — versions 2024-12-04
- Gaizhenbiao Gaizhenbiao/chuanhuchatgpt — versions unspecified
Weakness classification (CWE)
References
- huntr.com/bounties/21e54c3f-e2d7-423b-9890-1f0cb99af4dd (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-9216?
- CVE-2024-9216 is a high-severity vulnerability in Gaizhenbiao Chuanhuchatgpt, classified under Missing Critical Step in Authentication. CVSS score: 8.1/10. Published 2025-03-20.
- How severe is CVE-2024-9216?
- High severity. CVSS v3 base score is 8.1 out of 10.