CVE-2024-9919: Missing Authentication Check in parisneo/lollms-webui
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{appname} API endpoint does not call the checkaccess() function to verify the clientid, enabling attackers to delete directories without proper authentication.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9919?
CVE-2024-9919 has a high severity due to the potential for unauthorized directory deletions without proper authentication.
How do I fix CVE-2024-9919?
To resolve CVE-2024-9919, ensure that the uninstall endpoint correctly implements access controls to verify client identity.
What impact does CVE-2024-9919 have on lollms-webui?
CVE-2024-9919 allows attackers to delete applications without authorization, compromising the integrity of the lollms-webui environment.
Which versions of lollms-webui are affected by CVE-2024-9919?
CVE-2024-9919 affects all versions of parisneo lollms-webui V13 that do not have the fix in place.
How can attackers exploit CVE-2024-9919?
Attackers can exploit CVE-2024-9919 by sending requests to the /uninstall/{app_name} endpoint without authentication checks, leading to arbitrary directory deletions.