CVE-2024-5616: falha de média gravidade em mudler/localai
CSRF Vulnerability in mudler/LocalAI
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Produtos afetados
mudler · mudler/localaiCVEs relacionadas — mudler/localai
No mesmo produto, das mais perigosas para as menos.
CVE-2024-5182HIGHPath Traversal in mudler/localaiEPSS 25.5%CVE-2024-2029CRITICALCommand Injection in mudler/localaiEPSS 2.9%CVE-2024-5181CRITICALCommand Injection in mudler/localaiEPSS 2.7%CVE-2024-6095MEDIUMSSRF and Partial LFI in /models/apply Endpoint in mudler/localaiEPSS 2.6%CVE-2024-6868HIGHArbitrary File Write in mudler/LocalAIEPSS 1.5%CVE-2024-6983HIGHRemote Code Execution in mudler/localaiEPSS 1.3%