CVE-2024-4330

描述

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'list_personalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the directory structure and view the contents of any folder, albeit limited to subfolder names only. This issue was demonstrated via a specific HTTP request that manipulated the 'category' parameter to access arbitrary directories. The vulnerability is present in the code located at the 'endpoints/lollms_advanced.py' file.

如何修補 CVE-2024-4330

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本
• —未列出修補版本

CVE-2024-4330 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-9p73-x86v-jw57
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-4330
• PATCHgithub.com/ParisNeo/lollms
• PATCHpypi.org/project/lollms
• WEBgithub.com