CSRF Vulnerability in Lollms Profile Picture Upload Could Lead to Unauthorized File Uploads and Stored XSS
CVE-2024-2288

8.3HIGH

Key Information:

Vendor
Parisneo
Status
Parisneo/lollms-webui
Vendor
CVE Published:
6 June 2024

Summary

The Lollms application, developed by ParisNeo, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability in its profile picture upload feature. This vulnerability allows malicious actors to alter a victim's profile image without proper consent. Such unauthorized modifications can lead to a denial of service by saturating the filesystem with excessive file uploads. Furthermore, the vulnerability can serve as a vector for stored cross-site scripting (XSS) attacks, which give attackers the capability to run arbitrary JavaScript within the victim's browser context. The issue has been rectified in Lollms version 9.3.

Affected Version(s)

parisneo/lollms-webui < 9.3

References

https://huntr.com/bounties/2a37ae0c-890a-401a-8f3c-a261f3...
https://github.com/parisneo/lollms-webui/commit/ed085e6ef...

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.