CVE-2024-2360: Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
First published: Thu Jun 06 2024(Updated: )
parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Parisneo Lollms |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-2360?
CVE-2024-2360 has a high severity due to its potential for remote code execution.
How do I fix CVE-2024-2360?
To fix CVE-2024-2360, ensure proper input sanitization for the 'Database path' and 'PDF LaTeX path' settings to mitigate the path traversal risk.
Who is affected by CVE-2024-2360?
CVE-2024-2360 specifically affects users of the Lollms Web UI application.
What are the potential impacts of CVE-2024-2360?
The potential impacts of CVE-2024-2360 include unauthorized remote code execution, which can lead to system compromise.
Can CVE-2024-2360 be exploited remotely?
Yes, CVE-2024-2360 can be exploited remotely if an attacker manipulates the vulnerable input settings.
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lollms
- canonical/parisneo lollms