CVE-2024-8057

Description

In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to admin users. This can lead to excessive resource consumption, potentially resulting in a Denial of Service (DoS) and other significant issues, impacting the system's stability and security.

Reserved 2024-08-21 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-284 Improper Access Control

Product status

Any version
affected

References

huntr.com/bounties/b5991b98-a721-4acd-8ef2-980e15682913

cve.org (CVE-2024-8057)

nvd.nist.gov (CVE-2024-8057)

Download JSON