CVE-2024-10101

{"id": "CVE-2024-10101", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "published": "2024-10-17T19:15:21.713", "references": [{"url": "https://huntr.com/bounties/0436d96a-a2c4-4ca5-9f3c-fd68eb74d2cb", "source": "security@huntr.dev"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la versi\u00f3n 3.83 de binary-husky/gpt_academic. La vulnerabilidad se produce en el endpoint /file, que procesa archivos HTML. Los archivos HTML maliciosos que contienen payloads XSS se pueden cargar y almacenar en el backend, lo que lleva a la ejecuci\u00f3n de el payload en el navegador de la v\u00edctima cuando se accede al archivo. Esto puede provocar el robo de cookies de sesi\u00f3n u otra informaci\u00f3n confidencial."}], "lastModified": "2024-10-18T12:52:33.507", "sourceIdentifier": "security@huntr.dev"}