CVE - CVE-2024-32881

CVE-ID
CVE-2024-32881	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal Slack access. This issue was patched in version 3.63.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/danswer-ai/danswer/commit/89ff07a96b41be9e05256bd252105be233f4d28a URL:https://github.com/danswer-ai/danswer/commit/89ff07a96b41be9e05256bd252105be233f4d28a MISC:https://github.com/danswer-ai/danswer/commit/bd7e21a6388775e850d6f716675a893c72881e56 URL:https://github.com/danswer-ai/danswer/commit/bd7e21a6388775e850d6f716675a893c72881e56 MISC:https://github.com/danswer-ai/danswer/security/advisories/GHSA-xr9w-3ggr-hr6j URL:https://github.com/danswer-ai/danswer/security/advisories/GHSA-xr9w-3ggr-hr6j
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240419	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240419)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)