A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest. The affected functions include Elastic search Service (under construction), XTTS service, Petals service, vLLM service, and Motion Ctrl service, which lack CSRF protection. This vulnerability allows attackers to deceive users into unwittingly installing the XTTS service among other packages by submitting a malicious installation request. Successful exploitation results in attackers tricking users into performing actions without their consent.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff | Exploit Third Party Advisory |
| https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff | Exploit Third Party Advisory |
Configurations
History
07 Jul 2025, 17:31
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 3.3 |
| References | () https://huntr.com/bounties/dcfc5a07-0427-42b5-a623-8d943873d7ff - Exploit, Third Party Advisory | |
| CWE | ||
| CPE | cpe:2.3:a:lollms:lollms-webui:9.6:*:*:*:*:*:*:* | |
| First Time |
Lollms
Lollms lollms-webui |
24 Jun 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-24 13:15
Updated : 2025-07-07 17:31
NVD link : CVE-2024-4839
Mitre link : CVE-2024-4839
JSON object : View
Products Affected
lollms
- lollms-webui
CWE
No CWE.