CVE-2024-7038: Information Disclosure in open-webui/open-webui
An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existence and configuration of the file. This behavior allows an attacker to enumerate file names and traverse directories by observing the error messages, leading to potential exposure of sensitive information.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7038?
CVE-2024-7038 has been classified as a medium severity information disclosure vulnerability.
How do I fix CVE-2024-7038?
To remediate CVE-2024-7038, upgrade to open-webui version 0.3.9 or later where the vulnerability is addressed.
What could be the impact of exploiting CVE-2024-7038?
Exploiting CVE-2024-7038 may allow an attacker to gain unauthorized access to sensitive information through the model update feature.
Which versions of open-webui are affected by CVE-2024-7038?
CVE-2024-7038 affects all versions of open-webui up to and including version 0.3.8.
Is CVE-2024-7038 a remote or local vulnerability?
CVE-2024-7038 is considered a local vulnerability as it requires access to the admin settings to be exploited.