Arbitrary File Reading Vulnerability in Parisneo/Lollms Application
CVE-2024-3429

9.8CRITICAL

Key Information:

Vendor
Parisneo
Status
Parisneo/lollms
Vendor
CVE Published:
6 June 2024

Summary

A path traversal vulnerability exists within the lollms application developed by Parisneo, particularly in the sanitize_path_from_endpoint and sanitize_path methods located in the lollms_core\lollms\security.py file. This issue arises from inadequate sanitization of inputs provided by users, allowing malicious actors to bypass intended protections against path traversal. When the application operates on a Windows environment, an attacker can exploit this vulnerability to achieve arbitrary file reading capabilities. This exploitation could result in unauthorized access to sensitive files, revealing confidential information, and may also provoke denial of service (DoS) situations by leveraging resource-heavy files. The vulnerability impacts versions up to 9.5.

Affected Version(s)

parisneo/lollms < 9.6

References

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.