How severe is CVE-2024-10906?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.1 out of 10.

What type of vulnerability is CVE-2024-10906?

This is classified as CWE-352, which is a common weakness in software security.

CVE-2024-10906 - HIGH Severity | CVSS 7.1

Vulnerability Description

In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.

Related Vulnerabilities

CVE-2017-6038

HIGH

CVSS:7.1(High)

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were...

CWE-3522017

CVE-2017-6914

HIGH

CVSS:7.1(High)

CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. A user can be deleted.

CWE-3522017

CVE-2019-1003044

HIGH

CVSS:7.1(High)

A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtai...

CWE-3522019

CVE-2019-19664

HIGH

CVSS:7.1(High)

A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGener...

CWE-3522019

CVE-2020-10771

HIGH

CVSS:7.1(High)

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request...

CWE-3522020

CVE-2020-14368

HIGH

CVSS:7.1(High)

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing ...

CWE-3522020