CVE-2024-48145
Published: 24 October 2024
Summary
CVE-2024-48145 is a critical-severity Command Injection (CWE-77) vulnerability in Microsoft (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the LLM/Generative AI Risks risk domain; MITRE ATLAS techniques in scope: Direct (AML.T0051.000).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-42939
Vulnerability details
A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- LLM/Generative AI Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- The vulnerability affects ChatNet AI, an enterprise AI chat assistant with a chatbox, matching the Enterprise AI Assistants category due to its focus on AI-driven chat interfaces.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The prompt injection vulnerability in the public-facing chatbox enables exploitation of a public-facing application (T1190) to access and exfiltrate chat data from a messaging application (T1213.005).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.