CVE-2024-7819CWE-346

CORS Misconfiguration in danswer-ai/danswer

High · published March 20, 2025

CVSS v3.0
7.4
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.

The record
Technical detail
CVSS v3.0
7.4 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-346 · Origin Validation Error
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    CORS Misconfiguration in danswer-ai/danswer
    cvelistv5