CVE-2024-8065CWE-352

CSRF in danswer-ai/danswer

High · published March 20, 2025

CVSS v3.0
8.1
EPSS
0%
Percentile
11.0
In the wild
Unconfirmed
What it is

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00213 · 11.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    CSRF in danswer-ai/danswer
    cvelistv5