Home » Database

AVID-2026-R1612

Description

CSRF in danswer-ai/danswer (CVE-2024-8065)

Details

A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim’s browser. This includes connecting the victim’s application with a malicious Slack Bot, inviting users, and deleting chats, among other actions. The application does not implement any CSRF protection, making it susceptible to these attacks.

Reason for inclusion in AVID: The AVID candidate describes a CVE-2024-8065 CSRF vulnerability in danswer-ai/danswer, an AI-oriented software component. This vulnerability is in software used to build/deploy AI systems (web/app layer of an AI assistant framework), representing a software supply-chain issue within AI stacks. It is a genuine security vulnerability (CSRF leading to unauthorized actions). The report provides sufficient evidence (CVSS, description, references) to assess risk.

References

Affected or Relevant Artifacts

  • Developer: danswer-ai
  • Deployer: danswer-ai
  • Artifact Details:
TypeName
Systemdanswer-ai/danswer

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Base Score8.1
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-352CWE-352 Cross-Site Request Forgery (CSRF)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry