CVE-2024-4328: CSRF in clear_personality_files_list in parisneo/lollms-webui
A Cross-Site Request Forgery (CSRF) vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users into performing actions without their consent, such as deleting important files on the system. The issue is present in the application's handling of requests, making it susceptible to CSRF attacks that could lead to unauthorized actions being performed on behalf of the user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4328?
CVE-2024-4328 is classified as a Cross-Site Request Forgery (CSRF) vulnerability that could potentially lead to unauthorized actions being performed on behalf of authenticated users.
How do I fix CVE-2024-4328?
To fix CVE-2024-4328, implement proper CSRF protection mechanisms for the clear_personality_files_list function in the Lollms Webui.
Which version of Lollms Webui is affected by CVE-2024-4328?
CVE-2024-4328 affects Lollms Webui version 9.6.
What type of attack can exploit CVE-2024-4328?
CVE-2024-4328 can be exploited through a CSRF attack, allowing attackers to execute unauthorized commands on behalf of the user.
Is user authentication sufficient against CVE-2024-4328?
No, user authentication alone is not sufficient against CVE-2024-4328; CSRF tokens should also be employed to validate requests.