CVE-2024-4841 Vulnerability Details

  /     /     /  

CVE-2024-4841 Metadata Quick Info

CVE Published: 23/06/2024 | CVE Updated: 01/08/2024 | CVE Year: 2024
Source: @huntr_ai | Vendor: parisneo | Product: parisneo/lollms-webui
Status : PUBLISHED

---

CVE-2024-4841 Description

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the \'add_reference_to_local_mode\' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subfolders, and files present on the victim\'s computer. The vulnerability is present in the way the application handles the \'path\' parameter in HTTP requests to the \'/add_reference_to_local_model\' endpoint.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-29
CWE Name: CWE-29 Path Traversal: ..filename
Source: parisneo

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).