CVE-2024-7044: falha de média gravidade em open-webui/open-webui
Stored XSS in open-webui/open-webui
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.5%
A Stored Cross-Site Scripting (XSS) vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. This can lead to user data theft, session hijacking, malware distribution, and phishing attacks.
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
open-webui · open-webui/open-webuiCVEs relacionadas — open-webui/open-webui
No mesmo produto, das mais perigosas para as menos.
CVE-2024-7035MEDIUMCross-Site Request Forgery (CSRF) in open-webui/open-webuiEPSS 8.7%CVE-2024-7983HIGHDenial of Service in open-webui/open-webuiEPSS 0.9%CVE-2024-8053HIGHImproper Authentication in open-webui/open-webuiEPSS 0.7%CVE-2024-8017CRITICALCross-site Scripting (XSS) in open-webui/open-webuiEPSS 0.6%CVE-2024-7043HIGHImproper Access Control in open-webui/open-webuiEPSS 0.6%CVE-2024-7048MEDIUMIDOR in open-webui/open-webuiEPSS 0.4%