Описание
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
Ссылки
- Patch
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:librechat:librechat:0.7.5:rc2:*:*:*:*:*:*
EPSS
Процентиль: 21%
0.00068
Низкий
7.6 High
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-639
CWE-639
Связанные уязвимости
CVSS3: 7.6
github
11 месяцев назад
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
EPSS
Процентиль: 21%
0.00068
Низкий
7.6 High
CVSS3
6.5 Medium
CVSS3
Дефекты
CWE-639
CWE-639