CVE-2024-1522

Katalog CVE

CVSS 8.8 · High EPSS 0,45%

Kerentanan Cross-Site Request Forgery (CSRF) pada lollms web ui. Skor CVSS 3.0 8.8 (High) menurut huntr.dev.

Deskripsi (NVD)

A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requests, enabling an attacker to craft a malicious webpage that, when visited by a victim, submits a form to the victim's local lollms-webui instance to execute arbitrary OS commands. This issue allows attackers to take full control of the victim's system without requiring direct network access to the vulnerable application.

Rincian

Terbit di NVD

30 Maret 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

8.8 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 36,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2b patch
• https://huntr.com/bounties/687cef92-3432-4d6c-af92-868eccabbb71 exploit · issue tracking · patch · advisory pihak ketiga