PT-2024-33094 · Parisneo · Lollms-Webui

Published 2024-06-24 · Updated 2025-07-07 · CVE-2024-4839

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions 9.6 through the latest

Description A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function, affecting services such as Elastic search Service, XTTS service, Petals service, vLLM service, and Motion Ctrl service, which lack CSRF protection. This issue allows attackers to deceive users into unwittingly installing services by submitting malicious installation requests, resulting in users performing actions without their consent.

Recommendations For versions 9.6 through the latest, consider disabling the affected services, including Elastic search Service, XTTS service, Petals service, vLLM service, and Motion Ctrl service, until a patch is available to add CSRF protection. Restrict access to the 'Servers Configurations' function to minimize the risk of exploitation. Avoid using the function to install new services until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-4839

Affected Products

Lollms-Webui

References · 5

• 🔥 https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff · Exploit
• https://osv.dev/vulnerability/CVE-2024-4839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4839 · Security Note
• https://t.me/cvenotify/84175 · Telegram Post
• https://t.me/cvenotify/127881 · Telegram Post