An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their own account to an admin if the victim is an admin.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7 | Exploit Third Party Advisory |
Configurations
History
21 Jul 2025, 20:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Openwebui
Openwebui open Webui |
|
| CPE | cpe:2.3:a:openwebui:open_webui:*:*:*:*:*:*:*:* | |
| References | () https://huntr.com/bounties/ef06c7c8-1cb2-42a7-a6e6-17b2e1c744f7 - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-21 20:08
NVD link : CVE-2024-8017
Mitre link : CVE-2024-8017
JSON object : View
Products Affected
openwebui
- open_webui
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')