PT-2024-30466 · Parisneo · Lollms-Webui

Published 2024-05-30 · Updated 2024-06-02 · CVE-2024-4330

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version 9.6

Description A path traversal issue was identified due to improper handling of user-supplied input in the "list personalities" endpoint. An attacker can craft a malicious HTTP request to traverse the directory structure and view subfolder names by manipulating the category parameter. The issue is located in the 'endpoints/lollms advanced.py' file.

Recommendations For version 9.6, consider restricting access to the "list personalities" endpoint until a patch is available, or apply input validation to the category parameter to prevent directory traversal. As a temporary workaround, avoid using the category parameter in the affected endpoint to minimize the risk of exploitation.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-4330

GHSA-9P73-X86V-JW57

Affected Products

Lollms-Webui

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-4330 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4330 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p73-x86v-jw57 · Vendor Advisory
• https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7 · Patch
• https://github.com/ParisNeo/lollms/commit/0e52d59a06b7f05e3b2611ce7b053fafa44143a9 · Note
• https://github.com/ParisNeo/lollms · Note