Description
JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/cms/chat/delete, or /a/cms/chat/completions to read, delete, or append to the victim's AI chat transcripts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
thinkgem JeeSite
Default version status: unaffected
5.11.0 to ≤ 5.19.1affected
pkg:github/thinkgem/jeesite5References
- https://github.com/thinkgem/jeesite5/issues/43 ↗
- https://github.com/thinkgem/jeesite5 ↗
- https://github.com/thinkgem/jeesite5/commit/cbc5ba7a37fd93f38c46ef656bd31442fe6f8015 ↗
- https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/CacheChatMemoryRepository.java#L59-L62 ↗
- https://github.com/thinkgem/jeesite5/blob/5b5e2cf0adc45a1abe33d0f4ca149590d149b82d/modules/ai/ai-cms/src/main/java/com/jeesite/modules/ai/cms/service/AiCmsChatService.java#L111-L116 ↗
- https://hackmd.io/@hieund/jeesite5-ai-cms-chat-conversation-idor ↗
- https://www.vulncheck.com/advisories/jeesite-5.11.0-through-5.19.1-idor-in-ai-cms-chat-module ↗