CVE-2024-7959

🗓️ 20 Mar 2025 10:09:00Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 47 Views🌐 WEB

Vulnerability CVE-2024-7959 allows SSRF in open-webui version 0.3.8, risking internal access and command execution.

Reporter	Title	Published	Views	Family All 10
CNNVD	Open WebUI 代码问题漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-7959 SSRF in open-webui/open-webui	20 Mar 202510:09	–	cvelist
EUVD	EUVD-2025-6939	3 Oct 202520:07	–	euvd
Github Security Blog	Open WebUI has SSRF in /openai/models	20 Mar 202512:32	–	github
NVD	CVE-2024-7959	20 Mar 202510:15	–	nvd
OSV	GHSA-X757-HV69-JR45 Open WebUI has SSRF in /openai/models	20 Mar 202512:32	–	osv
Positive Technologies	PT-2025-12198 · Unknown · Open-Webui	20 Mar 202500:00	–	ptsecurity
RedhatCVE	CVE-2024-7959	22 Mar 202512:34	–	redhatcve
Snyk	Server-side Request Forgery (SSRF)	20 Mar 202512:32	–	snyk
Vulnrichment	CVE-2024-7959 SSRF in open-webui/open-webui	20 Mar 202510:09	–	vulnrichment

NVD

Node

openwebui open_webuiMatch0.3.8

[
  {
    "vendor": "open-webui",
    "product": "open-webui/open-webui",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/3c8bea0a-d678-4d67-bb9c-2b5b610a2193

Parameter	Position	Path	Description	CWE
openai_url	request body	/openai/models	SSRF via openai URL parameter allowing attacker to instruct server to fetch arbitrary URLs.	CWE-918

21 Jul 2025 20:06Current

7.8High risk

Vulners AI Score7.8

CVSS 3.17.7

CVSS 37.7

EPSS0.00514

SSVC

CWE-918