8.4
CVE-2024-9919
- EPSS 0.3%
- Veröffentlicht 20.03.2025 10:09:56
- Zuletzt bearbeitet 15.10.2025 13:15:59
- Quelle security@huntr.dev
- CVE-Watchlists
- Unerledigt
LoginMissing Authentication Check in parisneo/lollms-webui
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call the check_access() function to verify the client_id, enabling attackers to delete directories without proper authentication.Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lollms ≫ Lollms Web Ui Version13
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.3% | 0.211 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security@huntr.dev | 8.4 | 2.5 | 5.9 |
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-306 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
https://huntr.com/bounties/5c00f56b-32a8-4e26-a4e3-de64f139da6b