PT-2025-12202 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8017

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui versions <= 0.3.8

Description An XSS issue exists, specifically in the function that constructs the HTML for tooltips, allowing attackers to perform operations with the victim's privileges. This includes stealing chat history, deleting chats, and potentially escalating their own account to an admin if the victim is an admin.

Recommendations For versions <= 0.3.8, update to version 0.3.9 to resolve the issue. As a temporary workaround, consider restricting access to the tooltip functionality until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-8017

Affected Products

Open-Webui

References · 5

• 🔥 https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8017 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8017 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1902671156509053244 · Twitter Post
• https://twitter.com/CVEnew/status/1902670975164121232 · Twitter Post