Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-8065CSRF in danswer-ai/danswer

High 8.1

In plain English

A high-severity cross-site request forgery in danswer-ai/danswer from danswer-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.0)8.1High

Exploit odds (30 days)0.2%top 88.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

Affected products (as reported)

Vendor	Product	Versions
danswer-ai	danswer-ai/danswer	unspecified – through latest

Weakness: CWE-352 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

References

https://huntr.com/bounties/61b58753-af36-43fd-b1b9-f3019532dd08