CVE-2024-12880: Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow
A vulnerability in infiniflow/ragflow version RAGFlow-0.13.0 allows for partial account takeover via insecure data querying. The issue arises from the way tenant IDs are handled in the application. If a user has access to multiple tenants, they can manipulate their tenant access to query and access API tokens of other tenants. This vulnerability affects the following endpoints: /v1/system/tokenlist, /v1/system/newtoken, /v1/api/tokenlist, /v1/api/newtoken, and /v1/api/rm. An attacker can exploit this to access other tenants' API tokens, perform actions on behalf of other tenants, and access their data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12880?
The severity of CVE-2024-12880 is considered to be high due to its potential for partial account takeover.
How do I fix CVE-2024-12880?
To fix CVE-2024-12880, ensure proper validation and handling of tenant IDs to prevent insecure data querying.
What systems are affected by CVE-2024-12880?
CVE-2024-12880 affects infiniflow/ragflow version RAGFlow-0.13.0.
Can CVE-2024-12880 lead to data breaches?
Yes, CVE-2024-12880 could lead to data breaches through unauthorized access to other tenants' data.
Is there a workaround for CVE-2024-12880?
Currently, the recommended workaround for CVE-2024-12880 is to limit tenant access and review permissions until an official patch is released.