CVE-2024-3234: Path Traversal in gaizhenbiao/chuanhuchatgpt
gaizhenbiao · gaizhenbiao/chuanhuchatgpt
Vendor fix available · Affected: gaizhenbiao/chuanhuchatgpt · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 90% of scored CVEs
DescriptionCVE.org
The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- gaizhenbiao · gaizhenbiao/chuanhuchatgptbefore 20240305
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- Chuanhu Chat - Directory Traversal · nuclei template in projectdiscovery/nuclei-templates
- Vendor
- gaizhenbiao
- Published
- June 2024
CoverageNo articles yet
No CyberSIXT article names CVE-2024-3234 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.