Em resumo
- CVE-2024-10830 é uma vulnerabilidade ALTO (CVSS 8.2) que afeta dbgpt, db-gpt (dbgpt).
- Chance de exploração nos próximos 30 dias (EPSS): 0.73%, maior que 54.4% das vulnerabilidades.
- Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.
| Package | Affected versions | Patched versions |
|---|
| dbgpt PyPI | ≤ 0.6.0
| No fix yet |
| db-gpt | = 0.6.0
| No fix yet |
Description
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint /v1/resource/file/delete. This vulnerability allows an attacker to delete any file on the server by manipulating the file_key parameter. The file_key parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.
NVD description
A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` parameter is not properly sanitized, enabling an attacker to specify arbitrary file paths. If the specified file exists, the application will delete it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free