ByteOS Network

NVD Vulnerability Details :

CVE-2024-9617

Awaiting Analysis

Source-security@huntr.dev

Published At-20 Mar, 2025 | 10:15

Updated At-15 Oct, 2025 | 13:15

An IDOR vulnerability in danswer-ai/danswer v0.3.94 allows an attacker to view any files. The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/{file_id} interface to view any user's file.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.0	6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.0

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE ID	Type	Source
CWE-639	Primary	security@huntr.dev

CWE ID: CWE-639

Type: Primary

Source: security@huntr.dev

References

Hyperlink	Source	Resource
https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146	security@huntr.dev	N/A

Hyperlink: https://huntr.com/bounties/8f683ff6-3a99-41c6-b763-a8f7b73bd146

Source: security@huntr.dev

Resource: N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History