CVE-2024-8053

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-8053

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8053.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-8053

Aliases

Published

2025-03-20T10:11:13.561Z

Modified

2026-07-15T01:48:50.140160441Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Improper Authentication in open-webui/open-webui

Details

In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8053.json",
    "cwe_ids": [
        "CWE-306"
    ]
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

c74e7df6a04ec942af476332f4660f9d2a95fb7e

Last affected

c74e7df6a04ec942af476332f4660f9d2a95fb7e

Database specific

{
    "cpe": "cpe:2.3:a:openwebui:open_webui:0.3.10:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.3.10"
        },
        {
            "last_affected": "0.3.10"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*

0.3.10

v0.*

v0.3.10

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-8053.json"