{"data":{"id":"0a21e4a5-e5c8-4446-a38e-95ab8c2f054f","title":"CVE-2024-38514: NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a…","summary":"NextChat, a cross-platform ChatGPT/Gemini UI, contains a Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2024-38514 and CWE-918. The flaw stems from missing validation of the `endpoint` GET parameter on the WebDav API endpoint. The source says it can be used to make arbitrary HTTPS requests from the vulnerable instance (MKCOL, PUT and GET methods supported) or to make NextChat users execute arbitrary JavaScript in their browser.","solution":"Patched in version 2.12.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-38514","publishedAt":"2024-06-28T23:15:06.530Z","cveId":"CVE-2024-38514","cweIds":["CWE-918"],"cvssScore":"7.4","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["NextChat","ChatGPT","Gemini"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"NextChat server-side request forgery through WebDav API endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02168,"epssCheckedAt":"2026-11-04T18:09:13.655Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-29T00:11:26.172Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}