CVE-2024-5936

medium · 6.1

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft.

6.1

CVSS

30.1%

EPSS (exploit prob.)

98th

EPSS percentile

2024-06-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-601

Affected products

Vendor	Product	Affected versions
pribai	privategpt	0.5.0

Check a specific version with /api/v1/cve/match.

References

https://huntr.com/bounties/43f05c1e-d7b8-45e2-b1fe-48faf1e3a48d
https://huntr.com/bounties/43f05c1e-d7b8-45e2-b1fe-48faf1e3a48d

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-5936