PT-2024-37248 · Parisneo · Lollms-Webui

Published 2024-06-27 · Updated 2024-08-19 · CVE-2024-5933

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version latest

Description: A Cross-site Scripting (XSS) issue exists in the chat functionality, allowing an attacker to inject malicious scripts via chat messages. These scripts are then executed in the context of the user's browser.

Recommendations: For the latest version, consider disabling the chat functionality until a patch is available to prevent exploitation of this issue. Restrict access to the chat module to minimize the risk of malicious script injection. Avoid using the chat feature in the affected version until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-5933

Affected Products

Lollms-Webui

References · 4

• 🔥 https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517 · Exploit
• https://osv.dev/vulnerability/CVE-2024-5933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5933 · Security Note
• https://t.me/cvenotify/91194 · Telegram Post