Medium severity · published Mar 20, 2025
CVE-2024-9617
IDOR in danswer-ai/danswer
6.5
CVSS
1.7%
EPSS
No
On KEV
Description
An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
danswer-ai/danswer · danswer-ai
through latest · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9617
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9617
huntr.com
https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146
More from danswer-ai/danswer
9.1
CVE-2024-7957
Arbitrary File Overwrite in danswer-ai/danswer
8.1
CVE-2024-7767
Improper Access Control in danswer-ai/danswer
8.1
CVE-2024-8065
CSRF in danswer-ai/danswer
7.5
CVE-2025-0182
Denial of Service in danswer-ai/danswer
7.5
CVE-2024-8028
Denial of Service in danswer-ai/danswer