PT-2024-37791 · Unknown · Lollms-Webui

Published 2024-10-29 · Updated 2024-11-02 · CVE-2024-6674

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions lollms-webui versions prior to 10

Description A CORS misconfiguration allows attackers to steal sensitive information, such as logs, browser sessions, and settings containing private API keys from other services. This issue can also enable attackers to perform actions on behalf of a user, including deleting a project or sending a message, impacting the confidentiality and integrity of the information.

Recommendations For versions prior to 10, update to version 10 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information and implementing additional security measures to prevent unauthorized actions on behalf of a user.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2024-6674

Affected Products

Lollms-Webui

References · 6

• 🔥 https://huntr.com/bounties/e688f71b-a3a4-4f6d-b48a-837073fa6908 · Exploit
• https://github.com/parisneo/lollms-webui/commit/c1bb1ad19752aa7541675b398495eaf98fd589f1 · Patch
• https://osv.dev/vulnerability/CVE-2024-6674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6674 · Security Note
• https://twitter.com/UndercodeNews/status/1852548092362420551 · Twitter Post
• https://t.me/cvedetector/9320 · Telegram Post