What is the severity of CVE-2024-1600?

The severity of CVE-2024-1600 is considered high due to its potential for local file inclusion, allowing attackers to gain unauthorized access to sensitive files.

How do I fix CVE-2024-1600?

To fix CVE-2024-1600, it is recommended to update the parisneo/lollms-webui application to the latest version that addresses this vulnerability.

What type of vulnerability is CVE-2024-1600?

CVE-2024-1600 is classified as a Local File Inclusion (LFI) vulnerability, which allows an attacker to include files on a server through crafted URLs.

Can CVE-2024-1600 be exploited remotely?

Yes, CVE-2024-1600 can be remotely exploited by an attacker through the use of specially crafted URLs that include directory traversal sequences.

Vulnerability/
CVE-2024-1600

critical

9.3

CWE

10/4/2024

3/7/2024

CVE-2024-1600: Local File Inclusion in parisneo/lollms-webui

First published: Wed Apr 10 2024(Updated: )

A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.

Credit: security@huntr.dev

Affected Software	Affected Version	How to fix
parisneo lollms

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-1600?
The severity of CVE-2024-1600 is considered high due to its potential for local file inclusion, allowing attackers to gain unauthorized access to sensitive files.
How do I fix CVE-2024-1600?
To fix CVE-2024-1600, it is recommended to update the parisneo/lollms-webui application to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2024-1600?
CVE-2024-1600 is classified as a Local File Inclusion (LFI) vulnerability, which allows an attacker to include files on a server through crafted URLs.
Which application is affected by CVE-2024-1600?
CVE-2024-1600 affects the parisneo/lollms-webui application specifically within the /personalities route.
Can CVE-2024-1600 be exploited remotely?
Yes, CVE-2024-1600 can be remotely exploited by an attacker through the use of specially crafted URLs that include directory traversal sequences.

agent/weakness
agent/title
agent/references
agent/type
agent/description
agent/first-publish-date
collector/nvd-api
source/NVD
agent/severity
agent/author
agent/event
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/softwarecombine
agent/tags
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/parisneo
canonical/parisneo lollms

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.