CVE-2024-32881

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal Slack access. This issue was patched in version 3.63.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Apr 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-328822.7Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing thr CVE-2024-328837.7MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV (tag-length-value) structure to represent the meta data asso CVE-2024-328846.4gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` pr CVE-2024-328864.9Vitess is a database clustering system for horizontal scaling of MySQL. When executing the following simple query, the `vtgate` will go into CVE-2024-328875.5Sidekiq is simple, efficient background processing for Ruby. Sidekiq is reflected XSS vulnerability. The value of substr parameter is reflec CVE-2024-3288810.0The Amazon JDBC Driver for Redshift is a Type 4 JDBC driver that provides database connectivity through the standard JDBC application progra CVE-2024-32897.8When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior to 10.7.3 did not enforce sec CVE-2024-328906.1librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information CVE-2024-328917.0In sec_media_unprotect of media.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of pri CVE-2024-328927.8In handle_init of goodix/main/main.c, there is a possible memory corruption due to type confusion. This could lead to local escalation of pr CVE-2024-328935.5In _s5e9865_mif_set_rate of exynos_dvfs.c, there is a possible out of bounds read due to improper casting. This could lead to local informat CVE-2024-328947.5In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could lead