CVE-2024-2299: Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui
A stored Cross-Site Scripting (XSS) vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is executed when the file is accessed. This vulnerability is remotely exploitable via Cross-Site Request Forgery (CSRF), allowing attackers to perform actions on behalf of authenticated users and potentially leading to unauthorized access to sensitive information within the Lollms-webui application.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2299?
CVE-2024-2299 is considered a high severity vulnerability due to the ability for attackers to exploit stored cross-site scripting (XSS).
How do I fix CVE-2024-2299?
To fix CVE-2024-2299, ensure that proper validation and sanitization of uploaded files is implemented in the profile picture upload functionality to prevent malicious file uploads.
What software is affected by CVE-2024-2299?
CVE-2024-2299 specifically affects the parisneo/lollms-webui application.
What type of vulnerability is CVE-2024-2299?
CVE-2024-2299 is a stored Cross-Site Scripting (XSS) vulnerability.
How can attackers exploit CVE-2024-2299?
Attackers can exploit CVE-2024-2299 by uploading malicious HTML files containing JavaScript through the profile picture upload functionality.