CVE-2024-4403

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-4403
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Exploitability : 1.8 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851
https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851
Configurations

No configuration.

History

21 Nov 2024, 09:42

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de Cross-Site Request Forgery (CSRF) en la función restart_program de parisneo/lollms-webui v9.6. Esta vulnerabilidad permite a los atacantes engañar a los usuarios para que realicen acciones no deseadas, como restablecer el programa sin su conocimiento, mediante el envío de formularios CSRF especialmente manipulados. Este problema afecta el proceso de instalación, incluida la instalación de Binding zoo y Models zoo, al restablecer programas inesperadamente. La vulnerabilidad se debe a la falta de protección CSRF en la función afectada.
References () https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851 - () https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851 -

10 Jun 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-10 15:15

Updated : 2024-11-21 09:42

NVD link : CVE-2024-4403

Mitre link : CVE-2024-4403

CVE.ORG link : CVE-2024-4403

JSON object : View

Products Affected

No product.

CWE
CWE-352

Cross-Site Request Forgery (CSRF)