What is the severity of CVE-2024-4328?

CVE-2024-4328 is classified as a Cross-Site Request Forgery (CSRF) vulnerability that could potentially lead to unauthorized actions being performed on behalf of authenticated users.

How do I fix CVE-2024-4328?

To fix CVE-2024-4328, implement proper CSRF protection mechanisms for the clear_personality_files_list function in the Lollms Webui.

Which version of Lollms Webui is affected by CVE-2024-4328?

CVE-2024-4328 affects Lollms Webui version 9.6.

What type of attack can exploit CVE-2024-4328?

CVE-2024-4328 can be exploited through a CSRF attack, allowing attackers to execute unauthorized commands on behalf of the user.

Is user authentication sufficient against CVE-2024-4328?

No, user authentication alone is not sufficient against CVE-2024-4328; CSRF tokens should also be employed to validate requests.

Vulnerability/
CVE-2024-4328

high

8.1

CWE

352

EPSS

0.048%

10/6/2024

21/11/2024

CVE-2024-4328: CSRF in clear_personality_files_list in parisneo/lollms-webui

First published: Mon Jun 10 2024(Updated: )

A Cross-Site Request Forgery (CSRF) vulnerability exists in the clear_personality_files_list function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user.

Credit: security@huntr.dev

Affected Software	Affected Version	How to fix
Lollms Web UI	=9.6

Never miss a vulnerability like this again

Reference Links

https://huntr.com/bounties/0f4faadf-ebca-4ef8-9d8a-66dbd849c0f8

Frequently Asked Questions

What is the severity of CVE-2024-4328?
CVE-2024-4328 is classified as a Cross-Site Request Forgery (CSRF) vulnerability that could potentially lead to unauthorized actions being performed on behalf of authenticated users.
How do I fix CVE-2024-4328?
To fix CVE-2024-4328, implement proper CSRF protection mechanisms for the clear_personality_files_list function in the Lollms Webui.
Which version of Lollms Webui is affected by CVE-2024-4328?
CVE-2024-4328 affects Lollms Webui version 9.6.
What type of attack can exploit CVE-2024-4328?
CVE-2024-4328 can be exploited through a CSRF attack, allowing attackers to execute unauthorized commands on behalf of the user.
Is user authentication sufficient against CVE-2024-4328?
No, user authentication alone is not sufficient against CVE-2024-4328; CSRF tokens should also be employed to validate requests.

agent/weakness
agent/references
agent/title
agent/description
agent/type
agent/first-publish-date
agent/author
agent/event
agent/severity
collector/epss-latest
source/FIRST
agent/epss
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/source
agent/tags
agent/softwarecombine
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/parisneo
canonical/lollms web ui
version/lollms web ui/9.6

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.