5.4
CVE-2024-5935
- EPSS 0.06%
- Veröffentlicht 27.06.2024 19:15:18
- Zuletzt bearbeitet 19.05.2025 16:50:16
- Quelle security@huntr.dev
- CVE-Watchlists
- Unerledigt
LoginA Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Pribai ≫ Privategpt Version0.5.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.06% | 0.174 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.4 | 2.8 | 2.5 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
|
| security@huntr.dev | 5.4 | 2.8 | 2.5 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.