7.6

CVE-2024-10366

Exploit

IDOR in delete attachments in danny-avila/librechat

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Librechat ≫ Librechat Version0.7.5 Updaterc2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.262
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
security@huntr.dev 7.6 2.8 4.7
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://huntr.com/bounties/cde47cf8-dc81-46ab-b472-f7e44a981a7e
Third Party Advisory
Exploit
https://github.com/danny-avila/librechat/commit/a350443661d001ac55787741969a75d94ca14116
Patch