1553 matches found
CVE-2024-7045 Improper Access Control in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, improper access control vulnerabilities allow an attacker to view any prompts. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/prompts/ interface to retrieve all prompt...
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-7035
The CVE-2024-7035 issue affects open-webui/open-webui (v0.3.8). The underlying problem is CSRF because sensitive actions (delete/reset) are invoked via GET requests. Affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads, impactin...
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-7036
...
CVE-2024-7036
Open WebUI vulnerability CVE-2024-7036 is described in connected advisories as Open WebUI 0.3.8 containing an uncontrolled resource consumption flaw. An unauthenticated attacker can sign up with excessively large text in the name field, causing the Admin panel to become unresponsive and blocking ...
CVE-2024-7033
Open-WebUI (open-webui/open-webui) 0.3.8 contains an arbitrary file write vulnerability in the download_model endpoint. On Windows, improper path handling allows an attacker to manipulate the file path and write files to arbitrary locations on the server’s filesystem, potentially overwriting crit...
CVE-2024-7033 Arbitrary File Write in open-webui/open-webui
In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...
CVE-2024-7033
...
CVE-2024-7040 Improper Access Control in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the userid parameter, it is possible to view the chats of any administrator,...
CVE-2024-7040
Open WebUI (open-webui/open-webui) v0.3.8 contains an improper access control vulnerability on the frontend admin page. An administrator can view chats of other administrators by altering the user_id parameter, exposing admin chat logs. The issue is documented in Red Hat’s CVE entry and mirrored ...
CVE-2024-7040
...
CVE-2024-7046
Open-WebUI (open-webui) is affected by an improper access-control vulnerability in version 0.3.8. An attacker can call the API endpoint /api/v1/auths/admin/details to view the first admin (owner) details without verifying administrator privileges. Remediation: upgrade to open-webui version 0.5.8 ...
CVE-2024-7046 Improper Access Control in open-webui/open-webui
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows an attacker to view admin details. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the /api/v1/auths/admin/details interface to retrieve the first admin...