GitHub Advisoryadvisory · PyPI

GHSA-3248-f932-c76p DB-GPT vulnerable to Cross-Site Request Forgery

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-10906
Ecosystem
PyPI
Packages
dbgpt
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Weaknesses
CWE-352
Reviewed
2025-03-21

Affected packages

• PyPI dbgpt: <= 0.6.0 (no fix yet)

Description

In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.

Related

Alias · CVE (1)

  • CVE-2024-10906 In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware`… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References