CVE-2024-7983: Denial of Service in open-webui/open-webui
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until the conversion is complete.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7983?
CVE-2024-7983 has been classified as a denial of service vulnerability due to unprotected endpoint access.
How do I fix CVE-2024-7983?
To mitigate CVE-2024-7983, implement authentication for the markdown to HTML conversion endpoint in open-webui.
What are the consequences of exploiting CVE-2024-7983?
Exploiting CVE-2024-7983 can lead to a denial of service, causing the server to become unresponsive to legitimate requests.
Which version of open-webui is affected by CVE-2024-7983?
CVE-2024-7983 affects version 0.3.8 of open-webui.
Is there a workaround for CVE-2024-7983?
A possible workaround for CVE-2024-7983 is to restrict access to the markdown conversion endpoint until an authentication layer is implemented.