CVE-2024-11302: Missing check_access in lollms_binding_infos in parisneo/lollms
A missing checkaccess() function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the clientid value.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11302?
CVE-2024-11302 is considered a critical vulnerability due to its potential for unauthorized modifications in the lollms_binding_infos module.
How do I fix CVE-2024-11302?
To fix CVE-2024-11302, implement an access control check in the lollms_binding_infos module to validate permissions before performing binding operations.
What are the affected endpoints for CVE-2024-11302?
CVE-2024-11302 affects the /install_binding and /reinstall_binding endpoints, along with others in the lollms module.
Who is the vendor for CVE-2024-11302?
The vendor for CVE-2024-11302 is parisneo, responsible for the lollms repository.
What types of attacks can CVE-2024-11302 enable?
CVE-2024-11302 can enable attackers to add, modify, and remove bindings arbitrarily, leading to potential security breaches.