CVE-2024-7959
Open WebUI has SSRF in /openai/models
7.7
HIGH
CVSS 3.1
EPSS 24.5%
Description
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets.
How to fix CVE-2024-7959
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- —no fix listed
- —no fix listed
Is CVE-2024-7959 being exploited?
Moderate — EPSS is 24.5%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, <= 0.3.8
- from 0, <= 0.3.8
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.7 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |