CVE-2024-1646: Authentication Bypass in parisneo/lollms-webui
parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restartprogram', '/updatesoftware', '/checkupdate', '/startrecording', and '/stoprecording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1646?
The severity of CVE-2024-1646 is critical due to its potential for authentication bypass.
How do I fix CVE-2024-1646?
To fix CVE-2024-1646, implement proper access controls and validation on sensitive endpoints.
Which versions of lollms-webui are affected by CVE-2024-1646?
All versions of parisneo/lollms-webui are affected by CVE-2024-1646.
What kind of vulnerability is CVE-2024-1646?
CVE-2024-1646 is an authentication bypass vulnerability.
What are the implications of CVE-2024-1646?
The implications of CVE-2024-1646 include unauthorized access to sensitive functionality within the application.