CVE-2024-6281

2024-07-2004:15:05

CWE-440

@huntr_ai

web.nvd.nist.gov

path traversal

security vulnerability

parisneo/lollms

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

EPSS

Percentile

9.3%

JSON

A path traversal vulnerability exists in the apply_settings function of parisneo/lollms versions prior to 9.5.1. The sanitize_path function does not adequately secure the discussion_db_name parameter, allowing attackers to manipulate the path and potentially write to important system folders.

Affected configurations

Vulners

Vulnrichment

Node

parisneolollms_web_uiMatch9.5.1

VendorProductVersionCPE
parisneolollms_web_ui9.5.1cpe:2.3:a:parisneo:lollms_web_ui:9.5.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
parisneo	lollms_web_ui	9.5.1	cpe:2.3:a:parisneo:lollms_web_ui:9.5.1:::::::*

CNA Affected

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "9.5.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]