CVE-2024-1646

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

16/04/2024

Last modified:

15/08/2025

Description

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not &#39;0.0.0.0&#39; to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as &#39;/restart_program&#39;, &#39;/update_software&#39;, &#39;/check_update&#39;, &#39;/start_recording&#39;, and &#39;/stop_recording&#39;. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration.

Impact

Vector 3.x

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS v3.1 Severity and Metrics:

Base Score: 8.20 HIGH
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): High