CVE-2024-4841: fallo de gravedad media en parisneo/lollms-webui
Path Traversal in parisneo/lollms-webui
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
50Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 4epss 0.7%
de la publicación al arma
Publicada en NVD23 jun
VulnCheck+626d
A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim's computer. The vulnerability is present in the way the application handles the 'path' parameter in HTTP requests to the '/add_reference_to_local_model' endpoint.
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
parisneo · parisneo/lollms-webuiCVEs relacionadas — parisneo/lollms-webui
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-1520CRITICALOS Command Injection in parisneo/lollms-webuiEPSS 48.2%CVE-2024-1601HIGHSQL Injection in parisneo/lollms-webuiEPSS 40.4%CVE-2024-4320CRITICALRemote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webuiEPSS 34.4%CVE-2024-1600CRITICALLocal File Inclusion in parisneo/lollms-webuiEPSS 32.5%CVE-2024-4322HIGHPath Traversal in parisneo/lollms-webuiEPSS 30.8%CVE-2024-1873HIGHPath Traversal and Denial of Service in parisneo/lollms-webuiEPSS 13.4%