VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 20, 2025· Updated Apr 15, 2026

CVE-2024-9617

CVE-2024-9617

Description

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Danswer AI/Danswerinferred2 versions
    = 0.3.94+ 1 more
    • (no CPE)range: = 0.3.94
    • (no CPE)range: =0.3.94

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.