CVE-2023-34094

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-340959.8cpdb-libs provides frontend and backend libraries for the Common Printing Dialog Backends (CPDB) project. In versions 1.0 through 2.0b4, cpd CVE-2023-340968.8Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 an CVE-2023-340978.8hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when show CVE-2023-340985.3Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Jav CVE-2023-340995.3Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to constr CVE-2023-34105.4The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, CVE-2023-341006.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet CVE-2023-341019.1Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_inp CVE-2023-341028.8Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updatin CVE-2023-341035.4Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Script CVE-2023-341047.5fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not esca CVE-2023-341057.5SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and