CVE-2024-4403: CSRF in restart_program in parisneo/lollms-webui
First published: Mon Jun 10 2024(Updated: )
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| parisneo lollms |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-4403?
CVE-2024-4403 is classified as a medium severity vulnerability.
How do I fix CVE-2024-4403?
To mitigate CVE-2024-4403, implement CSRF protection measures in the restart_program function of the lollms-webui.
What types of systems are affected by CVE-2024-4403?
CVE-2024-4403 affects the parisneo/lollms-webui version 9.6.
What actions can be exploited due to CVE-2024-4403?
CVE-2024-4403 can be exploited to trick users into resetting the program without their consent.
Is CVE-2024-4403 a common vulnerability?
CVE-2024-4403 is categorized as a specific Cross-Site Request Forgery (CSRF) vulnerability which can be common in web applications.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/parisneo
- canonical/parisneo lollms