PT-2025-12297 · Unknown · Parisneo/Lollms-Webui

Published 2025-03-20 · Updated 2025-03-23 · CVE-2024-9919

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V13

Description A missing authentication check in the uninstall endpoint allows attackers to perform unauthorized directory deletions. The "/uninstall/{app name}" API endpoint does not call the check access() function to verify the client id, enabling attackers to delete directories without proper authentication.

Recommendations For parisneo/lollms-webui version V13, as a temporary workaround, consider disabling the /uninstall/{app name} API endpoint until a patch is available. Restrict access to the uninstall functionality to minimize the risk of exploitation. Avoid using the app name parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

CWE-304

Related Identifiers

CVE-2024-9919

Affected Products

Parisneo/Lollms-Webui

References · 6

• 🔥 https://huntr.com/bounties/5c00f56b-32a8-4e26-a4e3-de64f139da6b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-9919 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9919 · Vendor Advisory
• https://twitter.com/RedTeamNewsBlog/status/1903728465670795673 · Twitter Post
• https://twitter.com/CVEnew/status/1902968856995565675 · Twitter Post
• https://twitter.com/CveFindCom/status/1902669699491492260 · Twitter Post