CVE-2024-6674

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6674

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6674.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6674

Published

2024-10-29T13:15:08.263Z

Modified

2026-04-10T05:19:24.894700Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator

Summary

[none]

Details

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user, such as deleting a project or sending a message. The issue impacts the confidentiality and integrity of the information.

References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type: GIT
Repo: https://github.com/parisneo/lollms-webui
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c1bb1ad19752aa7541675b398495eaf98fd589f1

Affected versions

v0.*

v0.0.1

v0.0.2

v0.0.3

v0.0.5

v0.0.6

v0.0.7

v0.0.8

v0.0.9

v3.*

v3.0

v3.5

v4.*

v4.0

v5.*

v5.0

v6.*

v6.0

v6.5

v6.5.0

v6.5rc2

v6.7

v7.*

v7.0

v8.*

v8.5

v9.*

v9.0

v9.1

v9.2

v9.3

v9.4

v9.5

v9.6

v9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6674.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "10"
            }
        ]
    }
]