CVE-2024-2360
CVSS v3
9.8
CRITICAL
Score EPSS
9.7 %
probabilité d’exploitation
CISA KEV
Non
exploitation connue
Exploitation
—
statut SSVC
Description
parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.
Détails techniques
- Publiée le
- 2024-06-06
Questions fréquentes
Qu’est-ce que CVE-2024-2360 ?
parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute arbitrary code on the targeted server. The issue affects the latest version of the software. The vulnerability stems from the application's handling of the 'discussion_db_name' and 'pdf_latex_path' parameters, which do not properly validate file paths, allowing for directory traversal. This vulnerability can also lead to further file exposure and other attack vectors by manipulating the 'discussion_db_name' parameter.
CVE-2024-2360 est-elle activement exploitée ?
Aucune exploitation active de CVE-2024-2360 n’est confirmée. Le score EPSS est de 9.7 %, soit la probabilité estimée d’exploitation dans les 30 prochains jours.
Quel est le score CVSS de CVE-2024-2360 ?
CVE-2024-2360 a un score de base CVSS v3 de 9.8 (gravité CRITICAL).
CVE-2024-2360 touche-t-elle votre environnement ?
Utilisez isMalicious pour vérifier si l’une de vos IP ou l’un de vos domaines est associé aux IOC de cette vulnérabilité.
Sans carte bancaire · 500 vérifications gratuites par mois · Clé API gratuite
Autres vulnérabilités 2024 à trier
Classées par probabilité d’exploitation (EPSS).