Critical severity · published Apr 10, 2024
CVE-2024-1520
OS Command Injection in parisneo/lollms-webui
9.8
CVSS
48.2%
EPSS
No
On KEV
Description
An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)48.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parisneo/lollms-webui · parisneo
before 9.1 · source: vendor
LW
Lollms Web UI · Lollms
9.0 before 9.2 · source: NVD
LO
Lollms-webui · Parisneo
9.0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1520
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1520
Patch
https://github.com/parisneo/lollms-webui/commit/2497d1a4fe5a09f003bf7a9bc426139e9295a934
Exploit
https://huntr.com/bounties/405c2059-3fe9-4233-8eed-741ec847d181
More from parisneo/lollms-webui
9.8
CVE-2024-8898
Path Traversal in parisneo/lollms-webui
9.8
CVE-2024-2359
Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
9.8
CVE-2024-2360
Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
9.8
CVE-2024-3322
Path Traversal in parisneo/lollms-webui
9.8
CVE-2024-4320
Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui