CVE-2024-8065 | BDVDB-2026-270813 Detail

danswer-aidanswer-ai/danswer

Description#

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

Impact#

Per CVSS v3.0: confidentiality impact none, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

CWE-352 Cross-Site Request Forgery (CSRF)

References#

https://huntr.com/bounties/61b58753-af36-43fd-b1b9-f3019532dd08

Exploit#

No public exploit known

History#

Version 12025-03-20Record published in the CVE List.

Published

Published: 2025-03-20
Last modified: 2025-03-20

Vendor information

Vendor: danswer-ai
Product: danswer-ai/danswer

All danswer-ai vulnerabilities

Score

8.1 High

EPSS

less than 1%, Very Low

Estimated chance of exploitation in the next 30 days. EPSS percentile: 11.6.

KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog.

Impact

Cross-Site Request Forgery

Action

No specific action is recorded in the source data. Check the references for vendor guidance.

Affected Systems

Vulnerable
<= latest
Fixed
Not stated

Scoring System

CVSS v4.0

Not available

CVSS v3.1

Not available

CVSS v3.0

8.1 High

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Metric breakdown
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity	High
Availability	High

CVSS v2

Not available

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).