Cross-Site Request Forgery Vulnerability in eosphoros-ai/db-gpt
CVE-2024-10906
8.1HIGH
What is CVE-2024-10906?
The eosphoros-ai/db-gpt version 0.6.0 contains a security flaw due to the use of an overly permissive CORS policy in the uvicorn application. The CORSMiddleware configuration sets the Access-Control-Allow-Origin header to *, allowing all domains to access the application's endpoints. This misconfiguration exposes the application to Cross-Site Request Forgery (CSRF) attacks, enabling malicious actors to interact with any endpoints of the server instance, regardless of the instance's network exposure. Proper revisions to the CORS settings are crucial to mitigate this vulnerability and safeguard sensitive operations.
Affected Version(s)
eosphoros-ai/db-gpt <= unspecified
References
CVSS V3.1
Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
CVSS V3.0
Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved