Описание
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.
Ссылки
EPSS
Процентиль: 18%
0.00261
Низкий
7.4 High
CVSS3
Дефекты
CWE-639
Связанные уязвимости
CVSS3: 7.4
github
22 дня назад
Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks.
EPSS
Процентиль: 18%
0.00261
Низкий
7.4 High
CVSS3
Дефекты
CWE-639