A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lollms |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-44113 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 13 Sep 2024 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lollms
Lollms lollms |
|
| CPEs | cpe:2.3:a:lollms:lollms:9.6:*:*:*:*:*:*:* | |
| Vendors & Products |
Lollms
Lollms lollms |
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T20:40:47.283Z
Reserved: 2024-05-04T23:18:49.336Z
Link: CVE-2024-4499
Vulnrichment
Updated: 2024-08-01T20:40:47.283Z
NVD
Status : Modified
Published: 2024-06-24T03:15:09.797
Modified: 2024-11-21T09:42:57.480
Link: CVE-2024-4499
Redhat
No data.
OpenCVE Enrichment
No data.