CVE-2024-8065

CSRF in danswer-ai/danswer

State: Published
Severity: 8.1 High
Published: Mar 20, 2025
Updated: Mar 20, 2025
Reserved: Aug 21, 2024

Description

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

Scores

CVSS	Score	Vector	Source
3.0	8.1 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H	@huntr_ai

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
danswer-ai/danswerdanswer-ai	latest and earlierAffected

References

https://huntr.com/bounties/61b58753-af36-43fd-b1b9-f3019532dd08

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.