CVE-2024-9617 — IDOR in danswer-ai/danswer
An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowi…
Published: 2025-03-20 · CVSS: 6.5 · CVSS 3.0
An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7