High severity · published Mar 20, 2025
CVE-2024-7819
CORS Misconfiguration in danswer-ai/danswer
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DA
danswer-ai/danswer · danswer-ai
through latest · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7819
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7819
huntr.com
https://huntr.com/bounties/06a21857-e13f-4cf4-aa67-de11419a98c0
More from danswer-ai/danswer
9.1
CVE-2024-7957
Arbitrary File Overwrite in danswer-ai/danswer
8.1
CVE-2024-7767
Improper Access Control in danswer-ai/danswer
8.1
CVE-2024-8065
CSRF in danswer-ai/danswer
7.5
CVE-2025-0182
Denial of Service in danswer-ai/danswer
7.5
CVE-2024-8028
Denial of Service in danswer-ai/danswer