CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-4326

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.006

EPSS Ranking 69.0%

CVSS Severity

CVSS v3 Score 9.8

References

Products affected by CVE-2024-4326

Lollms » Lollms Web Ui » Version: N/A

cpe:2.3:a:lollms:lollms_web_ui:-
Lollms » Lollms Web Ui » Version: 0.0.1

cpe:2.3:a:lollms:lollms_web_ui:0.0.1
Lollms » Lollms Web Ui » Version: 0.0.2

cpe:2.3:a:lollms:lollms_web_ui:0.0.2
Lollms » Lollms Web Ui » Version: 0.0.3

cpe:2.3:a:lollms:lollms_web_ui:0.0.3
Lollms » Lollms Web Ui » Version: 0.0.4

cpe:2.3:a:lollms:lollms_web_ui:0.0.4
Lollms » Lollms Web Ui » Version: 0.0.5

cpe:2.3:a:lollms:lollms_web_ui:0.0.5
Lollms » Lollms Web Ui » Version: 0.0.6

cpe:2.3:a:lollms:lollms_web_ui:0.0.6
Lollms » Lollms Web Ui » Version: 0.0.7

cpe:2.3:a:lollms:lollms_web_ui:0.0.7
Lollms » Lollms Web Ui » Version: 0.0.8

cpe:2.3:a:lollms:lollms_web_ui:0.0.8
Lollms » Lollms Web Ui » Version: 0.0.9

cpe:2.3:a:lollms:lollms_web_ui:0.0.9
Lollms » Lollms Web Ui » Version: 3.0

cpe:2.3:a:lollms:lollms_web_ui:3.0
Lollms » Lollms Web Ui » Version: 3.5

cpe:2.3:a:lollms:lollms_web_ui:3.5
Lollms » Lollms Web Ui » Version: 4.0

cpe:2.3:a:lollms:lollms_web_ui:4.0
Lollms » Lollms Web Ui » Version: 5.0

cpe:2.3:a:lollms:lollms_web_ui:5.0
Lollms » Lollms Web Ui » Version: 6.0

cpe:2.3:a:lollms:lollms_web_ui:6.0
Lollms » Lollms Web Ui » Version: 6.5

cpe:2.3:a:lollms:lollms_web_ui:6.5
Lollms » Lollms Web Ui » Version: 6.5.0

cpe:2.3:a:lollms:lollms_web_ui:6.5.0
Lollms » Lollms Web Ui » Version: 6.7

cpe:2.3:a:lollms:lollms_web_ui:6.7
Lollms » Lollms Web Ui » Version: 7.0

cpe:2.3:a:lollms:lollms_web_ui:7.0
Lollms » Lollms Web Ui » Version: 8.0

cpe:2.3:a:lollms:lollms_web_ui:8.0
Lollms » Lollms Web Ui » Version: 8.5

cpe:2.3:a:lollms:lollms_web_ui:8.5
Lollms » Lollms Web Ui » Version: 9.0

cpe:2.3:a:lollms:lollms_web_ui:9.0
Lollms » Lollms Web Ui » Version: 9.1

cpe:2.3:a:lollms:lollms_web_ui:9.1
Lollms » Lollms Web Ui » Version: 9.2

cpe:2.3:a:lollms:lollms_web_ui:9.2
Lollms » Lollms Web Ui » Version: 9.3

cpe:2.3:a:lollms:lollms_web_ui:9.3
Lollms » Lollms Web Ui » Version: 9.4

cpe:2.3:a:lollms:lollms_web_ui:9.4

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2024-4326

Products

Pricing

Contact Us