CVE-2024-7819: CORS Misconfiguration in danswer-ai/danswer
A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7819?
CVE-2024-7819 is classified as a high severity vulnerability due to its potential to expose sensitive information.
What information can be stolen due to CVE-2024-7819?
CVE-2024-7819 can allow attackers to steal sensitive information such as chat contents and API keys.
How do I fix CVE-2024-7819?
To fix CVE-2024-7819, ensure proper validation of the origin header in CORS settings.
Which versions of Danswer AI are affected by CVE-2024-7819?
CVE-2024-7819 affects Danswer AI version 1.4.1.
What is the cause of CVE-2024-7819?
CVE-2024-7819 is caused by a CORS misconfiguration that allows unauthorized requests due to improper origin header validation.