CVE-2024-7957

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the load_credentials method, where user-controlled input for realm_name and zuliprc_content is used to construct file paths and write file contents. This allows attackers to overwrite or create arbitrary files if a zuliprc- directory already exists in the temporary directory.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-29

Affected software

Vendor	Product	Versions
danswer-ai	danswer-ai/danswer	>= unspecified, <= latest

References

https://huntr.com/bounties/21e9b909-036c-4544-ad35-6a5117836275

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-79609.1The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settin CVE-2024-79619.8A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary fi CVE-2024-79627.5An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading promp CVE-2024-79636.4The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in al CVE-2024-79648.8Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corrupt CVE-2024-79658.8Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption CVE-2024-79668.8Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proce CVE-2024-79678.8Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a CVE-2024-79688.8Use after free in Autofill in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had convinced the user to engage in specifi CVE-2024-79698.8Type Confusion in V8 in Google Chrome prior to 128.0.6613.113 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2024-79708.8Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a cr CVE-2024-79719.6Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (