Vulnerabilities > CVE-2024-3234 - Unspecified vulnerability in Gaizhenbiao Chuanhuchatgpt

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

gaizhenbiao

critical

NVD

Published: 2024-06-06

Updated: 2024-11-21

Summary

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.

Vulnerable Configurations

Part	Description	Count
Application	Gaizhenbiao Gaizhenbiao Chuanhuchatgpt - Gaizhenbiao Chuanhuchatgpt 20230303 Gaizhenbiao Chuanhuchatgpt 20230305 Gaizhenbiao Chuanhuchatgpt 20230307 Gaizhenbiao Chuanhuchatgpt 20230310 Gaizhenbiao Chuanhuchatgpt 20230314 Gaizhenbiao Chuanhuchatgpt 20230317 Gaizhenbiao Chuanhuchatgpt 20230320 Gaizhenbiao Chuanhuchatgpt 20230323 Gaizhenbiao Chuanhuchatgpt 20230327 Gaizhenbiao Chuanhuchatgpt 20230330 Gaizhenbiao Chuanhuchatgpt 20230405 Gaizhenbiao Chuanhuchatgpt 20230409 Gaizhenbiao Chuanhuchatgpt 20230413 Gaizhenbiao Chuanhuchatgpt 20230417 Gaizhenbiao Chuanhuchatgpt 20230422 Gaizhenbiao Chuanhuchatgpt 20230427 Gaizhenbiao Chuanhuchatgpt 20230502 Gaizhenbiao Chuanhuchatgpt 20230507 Gaizhenbiao Chuanhuchatgpt 20230513 Gaizhenbiao Chuanhuchatgpt 20230520 Gaizhenbiao Chuanhuchatgpt 20230526 Gaizhenbiao Chuanhuchatgpt 20230601 Gaizhenbiao Chuanhuchatgpt 20230614 Gaizhenbiao Chuanhuchatgpt 20230619 Gaizhenbiao Chuanhuchatgpt 20230628 Gaizhenbiao Chuanhuchatgpt 20230709 Gaizhenbiao Chuanhuchatgpt 20230719 Gaizhenbiao Chuanhuchatgpt 20230728 Gaizhenbiao Chuanhuchatgpt 20230809 Gaizhenbiao Chuanhuchatgpt 20230820 Gaizhenbiao Chuanhuchatgpt 20230830 Gaizhenbiao Chuanhuchatgpt 20230911 Gaizhenbiao Chuanhuchatgpt 20230916 Gaizhenbiao Chuanhuchatgpt 20230926 Gaizhenbiao Chuanhuchatgpt 20231006 Gaizhenbiao Chuanhuchatgpt 20231020 Gaizhenbiao Chuanhuchatgpt 20231110 Gaizhenbiao Chuanhuchatgpt 20231215 Gaizhenbiao Chuanhuchatgpt 20231223 Gaizhenbiao Chuanhuchatgpt 20240121	41

Summary

Vulnerable Configurations

References