CVE-2024-10829High· 7.5▾ MidnightPoC availableDB-GPT Uncontrolled Resource Consumption vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
1 GitHub repo
0.7% → 0.7%
A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries, leading to an infinite loop and complete denial of service for all users. This vulnerability affects all endpoints processing multipart/form-data requests.
dbgpt <= 0.6.0Refer to the advisory for the patched release.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-10902Critical· 9.1DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
CVE-2024-10831Critical· 9.1DB-GPT Absolute Path Traversal vulnerability
CVE-2024-10833Critical· 9.1DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload
CVE-2024-10901Critical· 9.1DB-GPT Arbitrary File Write vulnerability
CVE-2024-10835Critical· 9.1DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users
CVE-2024-10830High· 8.2DB-GPT Path Traversal vulnerability