mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 17:21:36 +00:00
64 lines
2.8 KiB
JSON
64 lines
2.8 KiB
JSON
{
|
|
"id": "CVE-2024-4330",
|
|
"sourceIdentifier": "security@huntr.dev",
|
|
"published": "2024-05-30T15:15:49.890",
|
|
"lastModified": "2024-11-21T09:42:38.397",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Se identific\u00f3 una vulnerabilidad de path traversal en el repositorio parisneo/lollms-webui, espec\u00edficamente en la versi\u00f3n 9.6. La vulnerabilidad surge debido al manejo inadecuado de la entrada proporcionada por el usuario en el endpoint 'list_personalities'. Al crear una solicitud HTTP maliciosa, un atacante puede atravesar la estructura del directorio y ver el contenido de cualquier carpeta, aunque limitado \u00fanicamente a los nombres de las subcarpetas. Este problema se demostr\u00f3 mediante una solicitud HTTP espec\u00edfica que manipulaba el par\u00e1metro 'categor\u00eda' para acceder a directorios arbitrarios. La vulnerabilidad est\u00e1 presente en el c\u00f3digo ubicado en el archivo 'endpoints/lollms_advanced.py'."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "security@huntr.dev",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
|
"baseScore": 4.0,
|
|
"baseSeverity": "MEDIUM",
|
|
"attackVector": "LOCAL",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "NONE",
|
|
"availabilityImpact": "NONE"
|
|
},
|
|
"exploitabilityScore": 2.5,
|
|
"impactScore": 1.4
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security@huntr.dev",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-23"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7",
|
|
"source": "security@huntr.dev"
|
|
},
|
|
{
|
|
"url": "https://huntr.com/bounties/154a78d5-3960-4fc6-8666-f982b5e70ed7",
|
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
|
}
|
|
]
|
|
} |