THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4328

CSRF in clear_personality_files_list in parisneo/lollms-webui

Reserved:2024-04-29
Published:2024-06-10
Updated:2024-06-10

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user.



MEDIUM: 4.0CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Any version
affected

References

https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8

cve.org CVE-2024-4328

nvd.nist.gov CVE-2024-4328

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4328