High severity · published Oct 29, 2024
CVE-2024-6674
Data Leak through CORS Misconfiguration in parisneo/lollms-webui
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parisneo/lollms-webui · parisneo
before 10 · source: vendor
LW
Lollms Web UI · Lollms
before 10 · source: NVD
LO
Lollms-webui · Parisneo
before 10 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6674
Patch
https://github.com/parisneo/lollms-webui/commit/c1bb1ad19752aa7541675b398495eaf98fd589f1
Exploit
https://huntr.com/bounties/e688f71b-a3a4-4f6d-b48a-837073fa6908
More from parisneo/lollms-webui
9.8
CVE-2024-8898
Path Traversal in parisneo/lollms-webui
9.8
CVE-2024-2359
Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
9.8
CVE-2024-2360
Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
9.8
CVE-2024-3322
Path Traversal in parisneo/lollms-webui
9.8
CVE-2024-4320
Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui