parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.
Metrics
Affected Vendors & Products
References
History
Tue, 15 Oct 2024 19:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Lollms
Lollms lollms Web Ui |
|
Weaknesses | NVD-CWE-Other | |
CPEs | cpe:2.3:a:lollms:lollms_web_ui:-:*:*:*:*:*:*:* | |
Vendors & Products |
Lollms
Lollms lollms Web Ui |
|
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2024-06-06T18:40:04.036Z
Updated: 2024-08-01T18:56:22.319Z
Reserved: 2024-02-24T23:17:57.497Z
Link: CVE-2024-1873
Vulnrichment
Updated: 2024-08-01T18:56:22.319Z
NVD
Status : Modified
Published: 2024-06-06T19:15:51.460
Modified: 2024-11-21T08:51:29.750
Link: CVE-2024-1873
Redhat
No data.