PT-2025-12181 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-7045

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8

Description The issue is related to improper access control, allowing an attacker to view any prompts without verifying if the attacker is an administrator. This enables the attacker to directly call the "/api/v1/prompts/" interface to retrieve all prompt information created by the admin, including ID values. The attacker can then exploit the "/api/v1/prompts/command/{command id}" interface to obtain arbitrary prompt information.

Recommendations For version v0.3.8, consider restricting access to the "/api/v1/prompts/" and "/api/v1/prompts/command/{command id}" interfaces until a proper access control mechanism is implemented to verify administrator privileges. As a temporary workaround, limit the exposure of prompt information by implementing additional security measures to prevent unauthorized access.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-1100

Related Identifiers

CVE-2024-7045

GHSA-C7FQ-P62P-WVPC

Affected Products

Open-Webui

References · 6

• 🔥 https://huntr.com/bounties/03ea0826-af7b-4717-b63e-90fd19675ab2 · Exploit
• https://osv.dev/vulnerability/GHSA-c7fq-p62p-wvpc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7045 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7045 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/1902671135617188314 · Twitter Post