Paper/Archive/CVE-2024-48144

CVE-2024-48144

fusionchat chat_ai_assistant — A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and…

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 46.4.464 × 209.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

chat_ai_assistant1.2.4.0–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refapps.microsoft.com/detail/9n3ff8j3d7zr?hl=en-US&gl=US refgithub.com/soursec/CVEs/tree/main/CVE-2024-48144