CVE-2024-4499 CSRF Vulnerability in parisneo/lollms XTTS Server

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

CVE-2024-4499

CVE-2024-4499 describes a CSRF vulnerability in the XTTS server of parisneo/lollms 9.6 caused by a lax CORS policy. An attacker can lure a user to a malicious page to trigger arbitrary LoLLMS-XTTS API requests, potentially leading to reading/writing of audio files and, in combination with other i...