CVE-2024-48140
Published: 24 October 2024
Summary
CVE-2024-48140 is a high-severity Command Injection (CWE-77) vulnerability in Google (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Messaging Applications (T1213.005); ranked at the 39.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain; MITRE ATLAS techniques in scope: LLM Prompt Injection (AML.T0051).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42934
Vulnerability details
A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica Your AI Copilot powered by ChatGPT4 v6.3.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a…
more
crafted message.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- The vulnerability is in Monica Your AI Copilot, an enterprise AI assistant powered by ChatGPT, fitting the Enterprise AI Assistants category.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prompt injection enables unauthorized access and exfiltration of chat data from the AI copilot's messaging interface, facilitating collection from messaging applications and unsecured credentials or information in chat messages.
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.