Summaryinfo

A vulnerability has been found in gaizhenbiao chuanhuchatgpt and classified as problematic. The affected element is an unknown function. Performing a manipulation results in cross site scripting. This vulnerability is identified as CVE-2024-8400. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability was found in gaizhenbiao chuanhuchatgpt. It has been classified as problematic. This affects an unknown part. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

A stored cross-site scripting (XSS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. This can lead to the execution of arbitrary JavaScript in the context of the user's browser.

It is possible to read the advisory at huntr.com. This vulnerability is uniquely identified as CVE-2024-8400 since 09/03/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

Upgrading to version 20240410 eliminates this vulnerability. Applying the patch 2cca68e34f029babbe4eaa5a77d220dad68fdd49 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• gaizhenbiao

Name

• chuanhuchatgpt

Version

• 20240305
• 20240310

License

• open-source

Website

• Product: https://github.com/gaizhenbiao/chuanhuchatgpt/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion