CVE-2024-7048

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-7048

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7048.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-7048

Published

2024-10-10T01:22:16.902Z

Modified

2026-07-15T01:49:04.493444620Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

IDOR in open-webui/open-webui

Details

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this vulnerability, an attacker can view metadata of files uploaded by an admin and overwrite these files, compromising the integrity and availability of the RAG models.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7048.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

9bcd4ce5c0a01af68c0d2aa44554a68bb741c61b

Last affected

9bcd4ce5c0a01af68c0d2aa44554a68bb741c61b

Database specific

{
    "cpe": "cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "0.3.8"
        },
        {
            "last_affected": "0.3.8"
        }
    ]
}

Affected versions

0.*

0.3.8

v0.*

v0.3.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7048.json"