CVE-2024-6707

Open WebUI Arbitrary File Upload + Path Traversal

CVSS 7.5 HIGHEPSS 1.0%CWE-22 CWE-434

Attacker controlled files can be uploaded to arbitrary locations on the web server's filesystem by abusing a path traversal vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

Open WebUI · Open WebUI

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://seclists.org/fulldisclosure/2024/Aug/4 https://korelogic.com/Resources/Advisories/KL-001-2024-006.txt http://www.openwall.com/lists/oss-security/2024/08/08/7