CVE-2024-12537: Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12537?
CVE-2024-12537 is classified as a critical vulnerability due to the absence of authentication mechanisms allowing unauthenticated access.
How do I fix CVE-2024-12537?
To fix CVE-2024-12537, implement authentication mechanisms for the `api/v1/utils/code/format` endpoint.
Who is affected by CVE-2024-12537?
CVE-2024-12537 affects users of version 0.3.32 of the open-webui/open-webui software.
What type of attack can exploit CVE-2024-12537?
CVE-2024-12537 can be exploited through a denial of service attack by sending a POST request with an excessively large payload.
Is there a patch available for CVE-2024-12537?
As of now, check for updates from open-webui for any patches addressing CVE-2024-12537.