PT-2024-18193 · Unknown · Parisneo/Lollms-Webui

Published 2024-04-15 · Updated 2025-07-07 · CVE-2024-1646

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui (affected versions not specified)

Description The issue is related to insufficient protection over sensitive endpoints, allowing for authentication bypass. The application's restriction method, which checks if the host parameter is not '0.0.0.0', is inadequate when the application is bound to a specific interface. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration. Sensitive endpoints include '/restart program', '/update software', '/check update', '/start recording', and '/stop recording'.

Recommendations As a temporary workaround, consider restricting access to the sensitive endpoints '/restart program', '/update software', '/check update', '/start recording', and '/stop recording' to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2024-1646

Affected Products

Parisneo/Lollms-Webui

References · 7

• 🔥 https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba · Exploit
• https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8 · Patch
• https://osv.dev/vulnerability/CVE-2024-1646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1646 · Security Note
• https://twitter.com/CVEnew/status/1780039218171134102 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1780114056059232725 · Twitter Post
• https://t.me/cvenotify/127852 · Telegram Post