CVE-2024-9901: Storage XSS and CSRF Vulnerability in mudler/localai
Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-48057. Notes: All CVE users should reference CVE-2024-48057 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9901?
The severity of CVE-2024-9901 is classified as medium due to its potential for enabling a cross-site scripting (XSS) attack.
How do I fix CVE-2024-9901?
To fix CVE-2024-9901, update LocalAI to version 2.19.5 or later, where the vulnerability has been addressed.
What type of vulnerability is CVE-2024-9901?
CVE-2024-9901 is a one-time storage cross-site scripting (XSS) vulnerability related to improper input neutralization in the delete model API.
How can CVE-2024-9901 affect my application?
CVE-2024-9901 can affect your application by allowing attackers to execute malicious scripts in the context of users' browsers, potentially compromising user data.
Which version of LocalAI is impacted by CVE-2024-9901?
CVE-2024-9901 impacts LocalAI version v2.19.4 specifically.