CVE-2024-7819

HIGH

danswer-ai/danswer < latest - Origin Validation Error in CORS Configuration

Title source: llm
STIX 2.1

Description

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.

References (1)

Core 1
Core References

Scores

CVSS v3 7.4
EPSS 0.0025
EPSS Percentile 16.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-346
Status published
Products (1)
danswer-ai/danswer-ai/danswer unspecified - latest
Published Mar 20, 2025
Tracked Since Feb 18, 2026