CVE-2024-6674
Data Leak through CORS Misconfiguration in parisneo/lollms-webui
- State
- Published
- Severity
- 8.1 High
- Published
- Oct 29, 2024
- Updated
- Oct 29, 2024
- Reserved
- Jul 10, 2024
Description
A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 8.1 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H | @huntr_ai |
Weaknesses
- CWE-346 Origin Validation Error
Affected Products
| Product | Versions |
|---|---|
parisneo/lollms-webuiparisneo |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.