CVE-2024-5186: Server Side Request Forgery (SSRF) in imartinez/privategpt
First published: Thu Jun 06 2024(Updated: )
A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically, by manipulating the 'path' parameter in a file upload request, an attacker can cause the application to make arbitrary requests to internal services, including the AWS metadata endpoint. This issue could lead to the exposure of internal servers and sensitive data.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zylon PrivateGPT | =0.5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-5186?
CVE-2024-5186 has a high severity due to its potential for unauthorized network access.
How do I fix CVE-2024-5186?
To fix CVE-2024-5186, upgrade to a patched version of imartinez/privategpt if available, and ensure proper input validation in the file upload section.
What systems are affected by CVE-2024-5186?
CVE-2024-5186 affects version 0.5.0 of imartinez/privategpt.
What kind of attacks can exploit CVE-2024-5186?
CVE-2024-5186 can be exploited via crafted requests that manipulate the file upload process to disclose sensitive information.
Is CVE-2024-5186 being actively exploited in the wild?
As of now, there is no public indication that CVE-2024-5186 is being actively exploited in the wild.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/zylon
- canonical/zylon privategpt
- version/zylon privategpt/0.5.0