Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

parisneo/lollms

Source

security@huntr.dev

CVE-2024-4499 details

Published : June 24, 2024, 3:15 a.m.
Last Modified : June 24, 2024, 12:57 p.m.

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.

CVSS Score

1	2	3	4	5	6	7.6	8	9	10

Weakness

Weakness	Name	Description
CWE-352	Cross-Site Request Forgery (CSRF)	The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

Base Score

7.6

Exploitability Score

2.8

Impact Score

4.7

Base Severity