Today > 2 Critical | 5 High | 12 Medium | 1 Low vulnerabilities - You can now download lists of IOCs here!

CVE-2024-6281

July 20, 2024, 4:15 a.m.

CVSS Score

7.3 / 10

Product(s) Impacted

UNKNOWN

Description

A path traversal vulnerability exists in the `apply_settings` function of parisneo/lollms versions prior to 9.5.1. The `sanitize_path` function does not adequately secure the `discussion_db_name` parameter, allowing attackers to manipulate the path and potentially write to important system folders.

Weaknesses

CWE-440

Expected Behavior Violation

A feature, API, or function does not perform according to its specification.

CWE ID: 440

Date

Published: July 20, 2024, 4:15 a.m.

Last Modified: July 20, 2024, 4:15 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@huntr.dev

CVSS Data

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

Base Score

7.3

Exploitability Score

2.5

Impact Score

4.7

Base Severity