Vulnerability · Published Mar 15, 2025 · Assigned by VulDB

CVE-2025-2334274056675 springboot-openai-chatgpt Chat History chat deleteChat access control

Medium 5.4

In plain English

A medium-severity improper access control in springboot-openai-chatgpt from 274056675. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.6%top 52.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
274056675	springboot-openai-chatgpt	e84f6f5

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

VDB-299799 | 274056675 springboot-openai-chatgpt Chat History chat deleteChat access control vdb-entry, technical-description
VDB-299799 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #505688 | 274056675 Web No version commitID e84f6f5 Improper Access Controls third-party-advisory
https://www.cnblogs.com/aibot/p/18732182 exploit