CVE-2024-5125: XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui
First published: Thu Nov 14 2024(Updated: )
parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| parisneo lollms |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5125?
CVE-2024-5125 is considered a high severity vulnerability due to its potential for exploitation through Cross-Site Scripting (XSS) and Open Redirect.
How do I fix CVE-2024-5125?
To fix CVE-2024-5125, ensure proper input validation and sanitization of SVG file uploads to prevent the execution of malicious JavaScript.
What types of vulnerabilities are present in CVE-2024-5125?
CVE-2024-5125 contains Cross-Site Scripting (XSS) and Open Redirect vulnerabilities as a result of inadequate input validation.
Which versions of lollms-webui are affected by CVE-2024-5125?
CVE-2024-5125 affects lollms-webui version 9.6.
What is the impact of CVE-2024-5125 on users?
The impact of CVE-2024-5125 includes potential execution of malicious scripts that can compromise user data and application integrity.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/parisneo
- canonical/parisneo lollms