CVEvulnerability

CVE-2024-4499

6.3 MEDIUM Published 2024-06-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-06-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS 3.0 ([email protected])
7.6 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Weaknesses
CWE-352

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.

Affected configurations

• lollms lollms 9.6

Related

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References