CVE-2024-4403: CSRF in restart_program in parisneo/lollms-webui

Published Jun 10, 2024

Updated

A Cross-Site Request Forgery (CSRF) vulnerability exists in the restartprogram function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.

Affected Software

2 affected components

parisneo lollms-webui

lollms lollms-webui=9.6

Event History

Jun 10, 2024

CVE Published

via MITRE·02:43 PM

Data Sourced

via MITRE·02:43 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-4403?

CVE-2024-4403 is classified as a medium severity vulnerability.

How do I fix CVE-2024-4403?

To mitigate CVE-2024-4403, implement CSRF protection measures in the restart_program function of the lollms-webui.

What types of systems are affected by CVE-2024-4403?

CVE-2024-4403 affects the parisneo/lollms-webui version 9.6.

What actions can be exploited due to CVE-2024-4403?

CVE-2024-4403 can be exploited to trick users into resetting the program without their consent.

Is CVE-2024-4403 a common vulnerability?

CVE-2024-4403 is categorized as a specific Cross-Site Request Forgery (CSRF) vulnerability which can be common in web applications.