CVE-2024-8057— Improper Access Control in danswer-ai/danswer
Quick assessment
Affected
danswer-ai danswer-ai/danswer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Danswer是Danswer AI开源的一个连接到公司文档、应用程序和人员的人工智能助手。 Danswer 0.4.1版本存在访问控制错误漏洞，该漏洞源于基本用户可以创建凭据并将其链接到现有连接器，可能导致资源过度消耗和拒绝服务。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-8057
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control in danswer-ai/danswer
Source: CVE Program / CVE List V5
Vulnerability Description
In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to admin users. This can lead to excessive resource consumption, potentially resulting in a Denial of Service (DoS) and other significant issues, impacting the system's stability and security.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Danswer 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Danswer是Danswer AI开源的一个连接到公司文档、应用程序和人员的人工智能助手。 Danswer 0.4.1版本存在访问控制错误漏洞，该漏洞源于基本用户可以创建凭据并将其链接到现有连接器，可能导致资源过度消耗和拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| danswer-ai | danswer-ai/danswer | unspecified ~ latest | - |
|
II. Public POCs for CVE-2024-8057
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-8057
请登录查看更多情报信息。
Vendor Advisories for CVE-2024-8057 (1)
Same Patch Batch · danswer-ai · 2025-03-20 · 10 CVEs total
| CVE-2025-0182 | Denial of Service in danswer-ai/danswer | |
| CVE-2024-7819 | CORS Misconfiguration in danswer-ai/danswer | |
| CVE-2024-7779 | ReDoS (Regular Expression Denial of Service) in danswer-ai/danswer | |
| CVE-2024-7767 | Improper Access Control in danswer-ai/danswer | |
| CVE-2024-7957 | Arbitrary File Overwrite in danswer-ai/danswer | |
| CVE-2024-8028 | Denial of Service in danswer-ai/danswer | |
| CVE-2024-8065 | CSRF in danswer-ai/danswer | |
| CVE-2024-9612 | Unauthorized Access in danswer-ai/danswer | |
| CVE-2024-9617 | IDOR in danswer-ai/danswer |
IV. Related Vulnerabilities
Same weakness: CWE-306
-
CVE-2026-105049
Zilliz Attu<3.0.0 Playground未授权访问漏洞 -
CVE-2026-95102
Monta monta.app Missing Authentication for Critical Function -
CVE-2026-82042
UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyF -
CVE-2026-103956
Missing authentication for critical function in Loom for AWS -
CVE-2026-104446
YesWiki before 4.6.7 Unauthenticated Open Mail Relay via Con
V. Comments for CVE-2024-8057
No comments yet