CVE-2024-10264 — HTTP Request Smuggling in netease-youdao/qanything

CVE-2024-10264

HTTP Request Smuggling in netease-youdao/qanything PUBLISHED

Description (CNA)

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.

Affected (CNA)

Vendor / product	Versions
netease-youdao / netease-youdao/qanything	affected unspecified through latest

CWE

CWE-444

References

https://huntr.com/bounties/988247d5-fd60-4d85-845a-e867d62c0d02

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.