CVE-2024-9612
Last modified
CVE-2024-9612 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. EPSS estimates a 0.66% chance of exploitation in the next 30 days.
Description
In danswer-ai/danswer v0.3.94, administrators can set the visibility of pages within a workspace, including the search page. When the search page is set to be invisible, regular users cannot view the search page or access its functionalities from the front-end interface. However, the back-end does not verify the visibility status of the search page. Consequently, attackers can directly call the API to access the functionalities provided by the search page, bypassing the visibility restriction set by the administrator.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Onyx | Onyx | 0.3.94 |
References
- https://huntr.com/bounties/c1046fa0-a719-475e-ba62-2b97873fbac4Exploit, Third Party Advisory
- https://huntr.com/bounties/c1046fa0-a719-475e-ba62-2b97873fbac4Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-9612?
How severe is CVE-2024-9612?
How do I fix CVE-2024-9612?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-9606In berriai/litellm before version 1.44.12, the `litellm/lite…7.5
- CVE-2024-9607The 10Web Social Post Feed plugin for WordPress is vulnerabl…6.1
- CVE-2024-9608The MyParcel plugin for WordPress is vulnerable to Reflected…6.1
- CVE-2024-9609The LearnPress Export Import – WordPress extension for Learn…6.1
- CVE-2024-9610The Language Switcher plugin for WordPress is vulnerable to …6.1
- CVE-2024-9611The Increase upload file size & Maximum Execution Time limit…6.1
- CVE-2024-9613The FormFacade – WordPress plugin for Google Forms plugin fo…6.1
- CVE-2024-9614The Constant Contact Forms by MailMunch plugin for WordPress…6.1
- CVE-2024-9615The BulkPress plugin for WordPress is vulnerable to Reflecte…6.1
- CVE-2024-9616The BlockMeister – Block Pattern Builder plugin for WordPres…6.1
- CVE-2024-9617An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows a…6.5
- CVE-2024-9618The Master Addons – Elementor Addons with White Label, Free …5.4
Are you affected by CVE-2024-9612?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST