PT-2024-30896 · Unknown · Parisneo/Lollms-Webui

Published 2024-06-10 · Updated 2024-06-10 · CVE-2024-4403

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version 9.6

Description A Cross-Site Request Forgery (CSRF) issue exists in the restart program function, allowing attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The issue is due to the lack of CSRF protection in the affected function.

Recommendations For parisneo/lollms-webui version 9.6, consider disabling the restart program function until a patch is available to prevent unintended actions. Restrict access to the installation process, including Binding zoo and Models zoo installations, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-4403

Affected Products

Parisneo/Lollms-Webui

References · 4

• 🔥 https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851 · Exploit
• https://osv.dev/vulnerability/CVE-2024-4403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4403 · Security Note
• https://twitter.com/VulmonFeeds/status/1800208186395283611 · Twitter Post