CVE-2024-7990: Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7990?
The severity of CVE-2024-7990 is classified as high due to the potential for remote code execution through stored XSS.
How do I fix CVE-2024-7990?
To fix CVE-2024-7990, ensure that all user inputs are properly sanitized and encoded before rendering them to prevent XSS.
Which versions of open-webui are affected by CVE-2024-7990?
CVE-2024-7990 affects open-webui version 0.3.8.
What type of vulnerability is CVE-2024-7990?
CVE-2024-7990 is a stored cross-site scripting (XSS) vulnerability.
Where is the vulnerability located in open-webui for CVE-2024-7990?
The vulnerability is located in the `/api/v1/models/add` endpoint of open-webui.