CVE-2024-37895: falha de média gravidade em lobehub lobe-chat
API Key Leak in lobe-chat
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.7epss 0.5%
Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
lobehub · lobe-chatCVEs relacionadas — lobehub lobe-chat
No mesmo produto, das mais perigosas para as menos.
CVE-2024-32964CRITICALlobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerabilityEPSS 53.0%CVE-2024-32965HIGHssrf vulnerability in lobe-chatEPSS 26.1%CVE-2024-47066CRITICALLobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)EPSS 11.9%CVE-2024-24566MEDIUMLobe Chat unauthorized access to pluginsEPSS 0.5%CVE-2025-59417MEDIUMLobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat MessagesEPSS 0.4%CVE-2026-23835MEDIUMLobeHub Vulnerable to Improper Authorization in Presigned UploadEPSS 0.4%