CVE-2024-5936
Published: 27 June 2024
Summary
CVE-2024-5936 is a medium-severity Open Redirect (CWE-601) vulnerability in Pribai Privategpt. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked in the top 13.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47065
Vulnerability details
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this…
more
vulnerability includes potential phishing attacks, malware distribution, and credential theft.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- PrivateGPT (imartinez/privategpt) is an open-source platform for running local/private AI assistants using LLMs for tasks like document Q&A, aligning with Enterprise AI Assistants as it provides assistant-like functionality with LLMs.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The open redirect vulnerability enables crafting malicious phishing links on a trusted domain that redirect users to attacker-controlled sites for phishing, malware distribution, and credential theft.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.