CVE-2023-49785: NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting
ChatGPTNextWeb · NextChat
Vendor fix available · Affected: ChatGPTNextWeb NextChat · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 99% of scored CVEs
DescriptionCVE.org
NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. As of time of publication, no patch is available, but other mitigation strategies are available. Users may avoid exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- ChatGPTNextWeb · NextChatup to and including 2.11.2
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- ChatGPT-Next-Web - SSRF/XSS · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Server-Side Request Forgery
- Vendor
- ChatGPTNextWeb
- Published
- March 2024
CoverageNo articles yet
No CyberSIXT article names CVE-2023-49785 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.