CVE-2024-9617CWE-639

IDOR in danswer-ai/danswer

Medium · published March 20, 2025

CVSS v3.0
6.5
EPSS
2%
Percentile
77.3
In the wild
Unconfirmed
What it is

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01722 · 77.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    IDOR in danswer-ai/danswer
    cvelistv5