What’s Vulnerable › Vulnerabilities
CVE-2024-7819: CORS Misconfiguration in danswer-ai/danswer
- Severity: high (CVSS 7.4 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-20 · updated 2026-06-17
- Weakness: CWE-346
Description
A CORS misconfiguration in danswer-ai/danswer v1.4.1 allows attackers to steal sensitive information such as chat contents, API keys, and other data. This vulnerability occurs due to improper validation of the origin header, enabling malicious web pages to make unauthorized requests to the application's API.
Affected products
- danswer-ai/danswer: through latest
References
Get alerted when CVE-2024-7819 or the next vulnerability affects your stack