CVE-2024-8065

8.1 highEPSS 0.2%

High (8.1). EPSS 0.2% chance of exploitation in the next 30 days.

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

Severity

CVSS 3.0

8.1 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2025-03-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://huntr.com/bounties/61b58753-af36-43fd-b1b9-f3019532dd08

Check your stack JSON