CVE-2024-7053

A vulnerability in open-webui/open-webui version 0.3.8 allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HT...

CVE-2024-7053

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-7053

...

CVE-2024-7053

Open WebUI (open-webui/open-webui) version 0.3.8 is affected by a session-fixation vulnerability. A user-level attacker can induce the administrator’s cookie to be sent over HTTP to a cross-origin domain due to SameSite=Lax and missing Secure flag, enabling cookie leakage via a malicious markdown...