CVE-2024-1873 — Path Traversal in Lollms-webui

CWE-22 — Path TraversalCWE-749 — Exposed Dangerous Method or Function2 documents2 sources
Severity
9.1CRITICALNVD
EPSS
2.4%
top 14.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Parisneo Lollms-webui
Timeline
PublishedJun 6

Description

parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, su…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages1 packages

▶CVEListV5parisneo/parisneo_lollms-webuiunspecified — v9.3

🔴Vulnerability Details

1
GHSA
GHSA-7gj2-fqjh-c4qg: parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0↗2024-06-06
▶