9.8

CVE-2024-4326

Exploit
A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lollms ≫ Lollms Web Ui Version < 9.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.13% 0.777
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@huntr.dev 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-15 External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user.

https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd
Patch
Third Party Advisory
Exploit
Issue Tracking