Vulnerability · Published Jun 27, 2024 · Assigned by @huntr_ai
CVE-2024-5936Open Redirect in imartinez/privategpt
Medium 4.3
In plain English
A medium-severity open redirect in imartinez/privategpt from imartinez. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 30.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| imartinez | imartinez/privategpt | unspecified – through latest |
Weakness: CWE-601 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N