CVE-2024-10101 — MEDIUM (5.4)

Vulnerability Description

A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backend, leading to the execution of the payload in the victim's browser when the file is accessed. This can result in the theft of session cookies or other sensitive information.

CVSS Score

5.4

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Binary-Husky	Gpt Academic	3.83

Related Weaknesses (CWE)

CWE-79

References

https://huntr.com/bounties/0436d96a-a2c4-4ca5-9f3c-fd68eb74d2cbExploitThird Party Advisory

FAQ

What is CVE-2024-10101?

CVE-2024-10101 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files conta...

How severe is CVE-2024-10101?

CVE-2024-10101 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-10101?

Check the references section above for vendor advisories and patch information. Affected products include: Binary-Husky Gpt Academic.