CVE-2024-7036

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-7036

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7036.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-7036

Aliases

Published

2025-03-20T10:09:57.731Z

Modified

2026-07-15T01:49:15.814147835Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Denial of Service in open-webui/open-webui

Details

A vulnerability in open-webui/open-webui v0.3.8 allows an unauthenticated attacker to sign up with excessively large text in the 'name' field, causing the Admin panel to become unresponsive. This prevents administrators from performing essential user management actions such as deleting, editing, or adding users. The vulnerability can also be exploited by authenticated users with low privileges, leading to the same unresponsive state in the Admin panel.

Database specific

{
    "cwe_ids": [
        "CWE-400"
    ],
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7036.json"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

9bcd4ce5c0a01af68c0d2aa44554a68bb741c61b

Last affected

9bcd4ce5c0a01af68c0d2aa44554a68bb741c61b

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.3.8"
        },
        {
            "last_affected": "0.3.8"
        }
    ],
    "cpe": "cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*",
    "source": "CPE_STRING"
}

Affected versions

0.*

0.3.8

v0.*

v0.3.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7036.json"