CVE-2024-3404

In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw allows an authenticated attacker to bypass intended access restrictions and read the `history` files of other users, potentially leading to unauthorized access to sensitive information. The vulnerability is present in the application's handling of access control for the `history` path, where no adequate mechanism is in place to prevent an authenticated user from accessing another user's chat history files. This issue poses a significant risk as it could allow attackers to obtain sensitive information from the chat history of other users.

• CWE-863

• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b
• https://huntr.com/bounties/ed32fc32-cb8f-4fbd-8209-cc835d279699Exploit, Issue Tracking, Patch, Third Party Advisory
• https://huntr.com/bounties/ed32fc32-cb8f-4fbd-8209-cc835d279699Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34031 Delta Electronics DIAEnergie is vulnerable to an SQL inject…8.8
• CVE-2024-34032 Delta Electronics DIAEnergie is vulnerable to an SQL inject…8.8
• CVE-2024-34033 Delta Electronics DIAEnergie has insufficient input validat…8.8
• CVE-2024-34034An issue was discovered in FlexRIC 2.0.0. It crashes during …5.7
• CVE-2024-34035An issue was discovered in O-RAN Near Realtime RIC H-Release…5.7
• CVE-2024-34036An issue was discovered in O-RAN Near Realtime RIC I-Release…4.3
• CVE-2024-34043O-RAN RICAPP kpimon-go I-Release has a segmentation violatio…5.3
• CVE-2024-34044The O-RAN E2T I-Release buildPrometheusList function can hav…5.3
• CVE-2024-34045The O-RAN E2T I-Release Prometheus metric Increment function…7.5
• CVE-2024-34046The O-RAN E2T I-Release Prometheus metric Increment function…7.5
• CVE-2024-34047O-RAN RIC I-Release e2mgr lacks array size checks in RicServ…4.3
• CVE-2024-34048O-RAN RIC I-Release e2mgr lacks array size checks in E2nodeC…9.8