CVE-2024-4839 | THREATINT

Assigner	@huntr_ai
Reserved	2024-05-13
Published	2024-06-24
Updated	2024-08-01

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service (under construction), XTTS service, Petals service, vLLM service, and Motion Ctrl service, which lack CSRF protection. This vulnerability allows attackers to deceive users into unwittingly installing the XTTS service among other packages by submitting a malicious installation request. Successful exploitation results in attackers tricking users into performing actions without their consent.

MEDIUM: 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Product status

Any version

affected

References

https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff

cve.org CVE-2024-4839

nvd.nist.gov CVE-2024-4839

Download JSON

https://cve.threatint.com/CVE/CVE-2024-4839

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat

Subscribe to our newsletter to learn more about our work.