CVE-2024-6845 SmartSearchWP < 2.4.6 - Unauthenticated OpenAI Key Disclosure
Unauthenticated attackers can retrieve the OpenAI API key via a REST endpoint lacking proper authorization in the Chatbot with ChatGPT plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6845?
CVE-2024-6845 is a medium-severity missing authorization vulnerability in Unknown Chatbot with ChatGPT WordPress, published on 25 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key
Weakness: CWE-862
Which versions are affected by CVE-2024-6845?
It affects 1 product.
Products include Webdigit Chatbot With Chatgpt.
How do I fix CVE-2024-6845?
No fix has been published for CVE-2024-6845 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6845 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6845 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Chatbot with ChatGPT WordPress
Sources
Also known as GHSA-2q3v-8m45-45jg.