CVE-2024-4403 CSRF in restart_program in parisneo/lollms-webui
Attackers can trick users into resetting the lollms-webui program via CSRF, disrupting installation processes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-4403?
CVE-2024-4403 is a medium-severity vulnerability in parisneo/lollms-webui, published on 10 Jun 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.
Weakness: CWE-352
Which versions are affected by CVE-2024-4403?
It affects 1 product.
Products include Lollms Lollms-Webui.
How do I fix CVE-2024-4403?
No fix has been published for CVE-2024-4403 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-4403 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-4403 exists.
Other vulnerabilities in parisneo/lollms-webui
- CVE-2024-4267 Remote Code Execution in parisneo/lollms-webui
- CVE-2024-1646 Authentication Bypass in parisneo/lollms-webui
- CVE-2024-1601 SQL Injection in parisneo/lollms-webui
- CVE-2024-5125 XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui
- CVE-2024-1569 Uncontrolled Resource Consumption in parisneo/lollms-webui
Sources
Also known as GHSA-8xp7-8ggj-xfq4.