CVE-2024-2288: CSRF File Upload Vulnerability in parisneo/lollms-webui
A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2288?
CVE-2024-2288 is classified as a high severity Cross-Site Request Forgery (CSRF) vulnerability.
How do I fix CVE-2024-2288?
To fix CVE-2024-2288, ensure you upgrade your Lollms application to version 7.3.1 or later.
What functionality is affected by CVE-2024-2288?
CVE-2024-2288 specifically affects the profile picture upload functionality in the Lollms application.
What versions of Lollms are impacted by CVE-2024-2288?
CVE-2024-2288 affects Lollms versions up to and including 7.3.0.
Can CVE-2024-2288 lead to unauthorized changes?
Yes, CVE-2024-2288 allows attackers to change a victim's profile picture without their consent.