CSRF in Lollms Lollms-Webui
CVE-2024-4403
A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (5.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 5th percentile — 5.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Lollms Lollms-Webui — versions 9.6
- Parisneo Parisneo/lollms-Webui — versions unspecified
Weakness classification (CWE)
References
- huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2024-4403?
- CVE-2024-4403 is a high-severity vulnerability in Lollms Lollms-Webui, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2024-06-10.
- How severe is CVE-2024-4403?
- High severity. CVSS v3 base score is 8.8 out of 10.