CVE-2024-8400
Last modified
CVE-2024-8400 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A stored cross-site scripting (XSS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
A stored cross-site scripting (XSS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. This can lead to the execution of arbitrary JavaScript in the context of the user's browser.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gaizhenbiao | Chuanhuchatgpt | < 20240410 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-8400?
How severe is CVE-2024-8400?
How do I fix CVE-2024-8400?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-8393The Woocommerce Blocks – Woolook plugin for WordPress is vul…6.6
- CVE-2024-8394When aborting the verification of an OTR chat session, an at…6.5
- CVE-2024-8395FlyCASS CASS and KCM systems did not correctly filter SQL qu…9.8
- CVE-2024-8397The webtoffee-gdpr-cookie-consent WordPress plugin before 2.…5.4
- CVE-2024-8398The Simple Nav Archives WordPress plugin through 2.1.3 does …4.3
- CVE-2024-8399Websites could utilize Javascript links to spoof URL address…4.7
- CVE-2024-8401CWE-79: Improper Neutralization of Input During Web Page Gen…5.4
- CVE-2024-8402An issue was discovered in GitLab EE affecting all versions …7.4
- CVE-2024-8403Improper Validation of Specified Type of Input vulnerability…7.5
- CVE-2024-8404An arbitrary file deletion vulnerability exists in PaperCut …7.8
- CVE-2024-8405An arbitrary file creation vulnerability exists in PaperCut …5.5
- CVE-2024-8407A vulnerability was found in alwindoss akademy up to 35cacce…5.4
Are you affected by CVE-2024-8400?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST