CVE-2024-3435: Path Traversal in parisneo/lollms-webui
A path traversal vulnerability exists in the 'savesettings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'applysettings' function, allowing an attacker to manipulate the application's configuration by sending specially crafted JSON payloads. This could lead to remote code execution (RCE) by bypassing existing patches designed to mitigate such vulnerabilities.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3435?
The severity of CVE-2024-3435 is considered critical due to the potential for unauthorized file access.
How do I fix CVE-2024-3435?
To fix CVE-2024-3435, update the lollms-webui application to version 9.5 or later where the vulnerability has been addressed.
What causes CVE-2024-3435?
CVE-2024-3435 is caused by insufficient sanitization of the 'config' parameter in the 'apply_settings' function.
Which versions of lollms-webui are affected by CVE-2024-3435?
CVE-2024-3435 affects all versions of lollms-webui prior to version 9.5.
What is a path traversal vulnerability in CVE-2024-3435?
A path traversal vulnerability like CVE-2024-3435 allows attackers to access files and directories outside of the application’s intended file structure.