CVE-2024-4328

HIGH

8.1

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published6/10/2024

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

parisneo:lollms_web_ui

Weaknesses (CWE)

CWE-352

References

https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8(security@huntr.dev)

https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.