CVE-2024-1511: Path Traversal Vulnerability in parisneo/lollms-webui
First published: Wed Apr 10 2024(Updated: )
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| parisneo lollms |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-1511?
CVE-2024-1511 is considered a critical vulnerability due to its potential to allow unauthenticated attackers to access and manipulate server files.
How do I fix CVE-2024-1511?
To mitigate CVE-2024-1511, ensure proper validation and sanitization of user-supplied file paths in the parisneo/lollms-webui application.
What types of systems are affected by CVE-2024-1511?
CVE-2024-1511 affects the parisneo/lollms-webui repository, particularly any systems that utilize this web UI framework.
Can CVE-2024-1511 be exploited remotely?
Yes, CVE-2024-1511 can be exploited remotely by unauthenticated attackers without any special privileges.
What are the potential impacts of exploiting CVE-2024-1511?
Exploiting CVE-2024-1511 can lead to unauthorized file access, modification, and potential execution of malicious code on the server.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/parisneo
- canonical/parisneo lollms