Vulnerability Description
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lollms | Lollms-Webui | 9.6 |
Related Weaknesses (CWE)
References
- https://github.com/parisneo/lollms-webui/commit/9b0f6c4ad1b9a2cd3466dcefaa278df3Patch
- https://huntr.com/bounties/e6ae8cfd-9f8b-41df-a0cc-1e7a47416995ExploitThird Party Advisory
- https://huntr.com/bounties/e6ae8cfd-9f8b-41df-a0cc-1e7a47416995ExploitThird Party Advisory
FAQ
What is CVE-2024-5125?
CVE-2024-5125 is a vulnerability with a CVSS score of 7.3 (HIGH). parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulner...
How severe is CVE-2024-5125?
CVE-2024-5125 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-5125?
Check the references section above for vendor advisories and patch information. Affected products include: Lollms Lollms-Webui.