CVE-2023-33979

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-33979
gpt_academic provides a graphical interface for ChatGPT/GLM. A vulnerability was found in gpt_academic 3.37 and prior. This issue affects some unknown processing of the component Configuration File Handler. The manipulation of the argument file leads to information disclosure. Since no sensitive files are configured to be off-limits, sensitive information files in some working directories can be read through the `/file` route, leading to sensitive information leakage. This affects users that uses file configurations via `config.py`, `config_private.py`, `Dockerfile`. A patch is available at commit 1dcc2873d2168ad2d3d70afcb453ac1695fbdf02. As a workaround, one may use environment variables instead of `config*.py` files to configure this project, or use docker-compose installation to configure this project.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 Patch
https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g Patch Vendor Advisory
https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 Patch
https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:*
History

07 Mar 2025, 15:30

Type Values Removed Values Added
First Time Binary-husky
Binary-husky gpt Academic
CPE cpe:2.3:a:gpt_academic_project:gpt_academic:*:*:*:*:*:*:*:* cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:*

21 Nov 2024, 08:06

Type Values Removed Values Added
References () https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 - Patch () https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 - Patch
References () https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g - Patch, Vendor Advisory () https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g - Patch, Vendor Advisory

08 Jun 2023, 13:41

Type Values Removed Values Added
References (MISC) https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g - (MISC) https://github.com/binary-husky/gpt_academic/security/advisories/GHSA-pg65-p24m-wf5g - Patch, Vendor Advisory
References (MISC) https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 - (MISC) https://github.com/binary-husky/gpt_academic/commit/1dcc2873d2168ad2d3d70afcb453ac1695fbdf02 - Patch
CPE cpe:2.3:a:gpt_academic_project:gpt_academic:*:*:*:*:*:*:*:*
CWE CWE-200
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

31 May 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-31 19:15

Updated : 2025-03-07 15:30

NVD link : CVE-2023-33979

Mitre link : CVE-2023-33979

CVE.ORG link : CVE-2023-33979

JSON object : View

Products Affected

binary-husky

  • gpt_academic
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor