CVE-2024-4267
May 22, 2024, 8:15 p.m.
8.4
High
Description
A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'open_file' function. An attacker can exploit this vulnerability by crafting a malicious file path that, when processed by the 'open_file' function, executes arbitrary system commands or reads sensitive file content. This issue is present in the code where subprocess.Popen is used unsafely to open files based on user-supplied paths without adequate validation, leading to potential command injection.
Product(s) Impacted
| Product | Versions |
|---|---|
| parisneo/lollms-webui |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
Tags
CVSS Score
CVSS Data - 3.0
- Attack Vector: LOCAL
- Attack Complexity: LOW
- Privileges Required: NONE
- Scope: UNCHANGED
- Confidentiality Impact: HIGH
- Integrity Impact: HIGH
- Availability Impact: HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
Published: May 22, 2024, 8:15 p.m.
Last Modified: May 22, 2024, 8:15 p.m.
Last Modified: May 22, 2024, 8:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@huntr.dev
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.