CVE-2024-5125

HIGH EPSS 22.9%
Published Nov 14, 20241y ago · Modified Jun 17, 20261w ago
7.3 CVSS 3.1
High
Find Similar
Published Nov 14, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.

CVSS Details

Base Score
7.3
Exploitability
1.8
Impact
5.5
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
22.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
lollmslollms-webui9.6any

References 2

  • github.com https://github.com/parisneo/lollms-webui/commit/9b0f6c4ad1b9a2cd3466dcefaa278df30feed67e
    Patch
  • huntr.com https://huntr.com/bounties/e6ae8cfd-9f8b-41df-a0cc-1e7a47416995
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/parisneo/lollms-webui/commit/9b0f6c4ad1b9a2cd3466dcefaa278df30feed67e
    Patch