CVE-2024-6035CWE-79

Stored XSS in gaizhenbiao/chuanhuchatgpt

High · published July 11, 2024

CVSS v3.0
7.4
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

A Stored Cross-Site Scripting (XSS) vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410. This vulnerability allows an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-07-11T10:41Z
EPSS history
Timeline
  • 11 JUL 10:41Z
    Stored XSS in gaizhenbiao/chuanhuchatgpt
    cvelistv5