Login Request a demo
High severity · published Jun 10, 2024
CVE-2024-4403
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Lollms-webui · Lollms
9.6 · source: NVD
Affected product
LO
Lollms-webui
Lollms
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4403
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4403
Exploit
https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851
More from Lollms-webui
9.8
CVE-2024-4267
A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5
9.8
CVE-2024-1601
An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message…
8.2
CVE-2024-1646
parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints
7.5
CVE-2024-1569
parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption
7.3
CVE-2024-5125
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload…