CVE-2024-32964
May 14, 2024, 4:12 p.m.
9.0
Critical
Description
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.
Product(s) Impacted
Product | Versions |
---|---|
Lobe Chat |
|
Weaknesses
Tags
CVSS Score
CVSS Data
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: HIGH
- Scope: CHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: LOW
- Availability Impact: HIGH
View Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
Date
- Published: May 14, 2024, 3:37 p.m.
- Last Modified: May 14, 2024, 4:12 p.m.
Status : Awaiting Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.
More infoSource
security-advisories@github.com
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.