CVE-2024-1511 — CRITICAL (9.8)

Vulnerability Description

The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Lollms	Lollms Web Ui	9.0

Related Weaknesses (CWE)

CWE-22

References

https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8bExploitThird Party Advisory
https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8bExploitThird Party Advisory

FAQ

What is CVE-2024-1511?

CVE-2024-1511 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, wr...

How severe is CVE-2024-1511?

CVE-2024-1511 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-1511?

Check the references section above for vendor advisories and patch information. Affected products include: Lollms Lollms Web Ui.