DifyTap Bugs Let Attackers 'Wiretap' AI Chat Histories

Summary

Four critical vulnerabilities have been discovered in Dify, an open-source platform used for building and managing AI applications. These flaws could allow attackers to silently access and steal sensitive data, including chat histories, from users of the platform. The vulnerabilities are being tracked as CVE-2024-28910, CVE-2024-28911, CVE-2024-28912, and CVE-2024-28913, and affect versions prior to 0.6.1.

Indicators of Compromise

• cve — CVE-2024-28910
• cve — CVE-2024-28911
• cve — CVE-2024-28912
• cve — CVE-2024-28913

Entities