CVE-2024-30256: GHSL-2024-033: Server-Side Request Forgery (SSRF) in open-webui - CVE-2024-30256
Published Apr 16, 2024
·Updated
Open WebUI is a user-friendly WebUI for LLMs. Open-webui is vulnerable to authenticated blind server-side request forgery. This vulnerability is fixed in 0.1.117.
Affected Software
2 affected components
Open WebUI Open WebUI<0.1.117
openwebui Open WebUI<0.1.117
Event History
Apr 16, 2024
CVE Published
via MITRE·02:24 PM
Data Sourced
via MITRE·02:24 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Apr 18, 2024
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-30256?
CVE-2024-30256 is classified as a moderate severity vulnerability involving authenticated blind server-side request forgery.
2
Which versions of Open WebUI are affected by CVE-2024-30256?
CVE-2024-30256 affects versions of Open WebUI prior to 0.1.117.
3
How do I fix CVE-2024-30256?
To fix CVE-2024-30256, upgrade Open WebUI to version 0.1.117 or later.
4
What kind of vulnerability is CVE-2024-30256?
CVE-2024-30256 is an authenticated blind server-side request forgery vulnerability.
5
Is CVE-2024-30256 easy to exploit?
Exploitation of CVE-2024-30256 requires authentication, which may limit its potential impact depending on access policies.