CVE-2024-7819

published 2025-03-20

CVE-2024-7819: A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This…

Priority P3 37 high 7.4 CVSS 3.0

AV N AC L PR N UI R S C C H I N A N

A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
danswer-ai	danswer-ai_danswer	unspecified – latest	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-346